# Controlled build and corresponding-source delivery

## Proven source identity versus optional unperformed build

Official npm signed provenance binds `supersonic-scsynth-core@0.57.0` to source revision `5007806c512f5a78e0cc1de23f4642c5a34b4188`, release tag v0.57.0 and upstream workflow run 22458007104. Package WASM/worklet hashes match installed artifacts. This verifies an upstream source association, not independent bit-for-bit reproduction.

The release workflow uses Emscripten **4.0.21**, Node **22.x**, npm@latest and esbuild setup. The repository Dockerfile's 4.0.17 is a different example. Do not describe that Dockerfile as the exact release environment. Historical npm/esbuild minor versions and mutable action revisions are not fully recovered; expired logs prevent recovery here. A reproducible new build can pin new explicit compatible values, but cannot honestly claim those values were used for the historical release.

## Optional engineering rebuild recipe (not executed; not a license condition)

Use an isolated disposable build environment, Node 22.x, Bash, Python, Emscripten SDK 4.0.21 and esbuild. These commands are build preparation instructions, never deployment instructions.

```sh
# After verifying/reconstructing the supplied source archive and extracting it:
cd supersonic-source
# Activate a separately obtained, verified Emscripten SDK installation:
. /path/to/emsdk/emsdk_env.sh
emcc --version  # must report 4.0.21
node --version # record actual Node 22.x patch version
npm --version
# The exact upstream archive has NO dependency lockfile. First create and
# review a new candidate lock (not historical-release dependency recovery):
npm install --package-lock-only --ignore-scripts
# Review/archive that lock before installing:
npm ci --ignore-scripts
export PATH="$PWD/node_modules/.bin:$PATH"
esbuild --version
./build.sh --release > engine-build.log 2>&1
```

`npm ci --ignore-scripts` is a controlled candidate dependency installation, **not asserted identical to upstream's npm install**. The pinned tree has no lockfile; producing and reviewing the new dependency lock is a mandatory unperformed step before this recipe can be called reproducible. Inspect dependency install/build scripts rather than silently enabling lifecycle scripts. The esbuild executable must be installed and permitted in the isolated environment; a blocked esbuild install requires explicitly arranging the platform binary. Record SDK/source/dependency hashes, system image identity and full logs. Compare rebuilt WASM/worklet hashes against `../provenance/verification.json`; differing bytes require functional/ABI tests and explanation, not an automatic claim of source mismatch or equivalence. Keep existing runtime until an approved tested replacement.

The optional sample/synthdef directory branches in `build.sh` only create media symlinks after engine/JS compilation. They are not emcc/esbuild source inputs. A proposed engine source archive can omit `packages/supersonic-scsynth-samples/samples/` and `packages/supersonic-scsynth-synthdefs/synthdefs/` while retaining package notices/metadata, all src/js/scripts and build files, with an explicit omission manifest. The retained-input and payload checks support corresponding-source coverage. A rebuild is a recommended engineering confidence check, not a mandatory distributor self-rebuild condition. No specific required engine source file is identified as missing.

## Visitor delivery checklist — mandatory before public release

1. Deliver accessible complete corresponding source alongside the runtime binaries under GPLv3 section 6(d), without access restrictions or additional charge. Do not rely on a private repository link, npm availability alone, or an email request.
2. Put a visible **Licenses and corresponding source** link near the installation. Link to the actual publicly hosted notices, version manifest, source parts, reconstruction instructions, required build scripts, native/toolchain notices and applicable local modifications. No public URL is approved or provisioned yet.
3. Serve all source parts directly and test unauthenticated downloads/reassembly against SHA-256. Current raw source archive is 43,439,283 bytes, exceeding the proposed static host per-file limit; verified parts or a reviewed smaller source archive avoid that limit. Avoid assuming a separate source server is necessary.
4. Preserve original source/header copyright and license notices, the full GPLv3 text, and applicable permissive notices. Clearly record any source filtering or changes; include local covered-code modifications and sufficient installation/build information where required.
5. Verify full source package contains what is needed to generate, install and run the covered object code; include interface definitions and build-control scripts. SDK/runtime source references need exact versions and an assessment of GPL system-library/toolchain exceptions, not an unsupported assertion that every compiler source must be copied.
6. Keep source and notices available with each distributed version and archive the release manifest. State GPL warranty limitations and recipient redistribution/modification rights.
7. Review final combined-work scope under actual license terms. The upstream architectural-intent paragraph is guidance, not a GPL exception. Publishing covered local portions under compatible terms is an available route; special permission/negotiation is not a default requirement.

Reference: https://www.gnu.org/licenses/gpl-3.0.html#section6 and https://www.gnu.org/licenses/gpl-faq.html#SourceAndBinaryOnDifferentSites . No absolute legal guarantee is made. A successful distributor rebuild and professional legal review are not themselves license conditions. Current requirements classification is in LICENSE-REQUIREMENTS.md.