# Contracts: Verifying an App

The whole point of content addressing is that you can *verify*. To confirm an app is exactly what it claims:

1. **Recompile the source** and check the hash matches the on-chain component hash. (Same bytes ⇒ same hash.)
2. **Render against multiple RPCs** and diff — byte-identical output proves nothing is injected by a provider.
3. **Read the grade** (`TrustGradeView.analyze`) and check the deviation list matches what you expect.
4. **Check the version posture** (`SubnameVersionRegistry.nameInfo`) — is the name frozen, or timelocked with a
   pending version? A pending version is public and delayed; you can audit it before it activates.

Nothing requires trusting an operator. Everything is a reproducible read. This is the guarantee ChainRender exists
to provide.