# Reproduce the Indonesian IAG2 data

Download the complete `/sources/id/` directory listed in `SOURCE-MANIFEST.json` and `publication-manifest.json` into a fresh directory. No private repository access is needed. The build sources named `iag2-*.ts` are editable GPL-3.0-only copies of the relevant canonical IAG2 encoder, scanner, manifest validator and minimal type contracts. The published candidate and generation lock are the only data inputs. Node.js 24.x and the public `tsx` 4.20.3 package are the toolchain; install or prepare them separately before going offline.

From the downloaded source directory, with the network disabled, run:

```
node --import file:///absolute/path/to/tsx/dist/loader.mjs reproduce-from-candidate-v1.mts generation-lock.json candidate.tsv /absolute/path/to/fresh-output-directory
```

The output directory must not exist. The script validates the candidate SHA-256, row schema and count, uses the included canonical IAG2 build-source copy, then rejects a different manifest or any asset byte/hash mismatch. It emits exactly the 29 published files. All module imports remain inside the downloaded directory except Node builtins and the separately prepared `tsx` loader. `policy.json`, `curation-v4.json`, `inputs.lock.json`, `generate-id-v4.mts`, and `source-gate.mjs` document and reproduce the earlier selection pipeline when the pinned external inputs are also available; they are not needed for the direct candidate-to-IAG2 path.

To audit reacquisition, download the files from `source-identities-v4.json` into a separate directory and run `node verify-acquisition.mjs <external-input-root>`. Do not place bulk inputs in the source directory.