# Offline reproduction

Node.js 24.14.1 was used for the locked package. From a fresh extraction of this source directory, run `node REPRODUCE.mjs NEW_EMPTY_OUTPUT_DIRECTORY`. The command disables network access in the builder process, checks candidate, policy and curation hashes, builds all assets with the included `compiled/` IAG2 source, and compares every output byte count and SHA-256 to `generation-lock.json`. No private repository, prior review archive or cache is needed. The output directory must not exist yet. The builder itself contains no timestamps or local paths in deterministic output; its diagnostic `package-report.json` contains an elapsed-time measurement and is outside the asset lock.

To regenerate the editable candidate from publisher raw data, first download the exact ZIP URL in `SOURCE.md` into an explicit `SOURCE_ROOT/KRISTINsnid.csv.zip`. Verify its size and SHA-256. Extract the member to `SOURCE_ROOT/KRISTIN-unpacked/KRISTINsnid.csv` without changing bytes; verify its size and SHA-256 and the checksum member. Then run `node generate-candidate.mjs SOURCE_ROOT NEW_EMPTY_GENERATION_DIRECTORY`. That generator checks both raw identities, strict UTF-8, all 15 fields and the policy before writing. Compare `NEW_EMPTY_GENERATION_DIRECTORY/bin-candidate.tsv` byte-for-byte with `candidate.tsv`. The publisher raw bulk is not needed to reproduce the already selected asset package offline.