docs/architecture/decisions/0052-reviewed-license-supplements.md

@@ -76,6 +76,9 @@ exact dependency.
   versioned inputs. A supplement enters only through Ekklesia's normal reviewed change process, and
   the change that adds it is its review. A given packager version therefore always carries the same
   supplements.
+- **What that review is.** Repository review of a supplement is project and code review of a build
+  input: whether its content, its exact match, and its provenance are what the change says they are.
+  It is not legal review, and it does not prove that any redistribution obligation is satisfied.
 - **What a supplement may contain:**
   - licence texts;
   - copyright and attribution notices;
@@ -93,9 +96,15 @@ A supplement names exactly one redistributed package:
 
 - its package name;
 - its exact version;
-- an integrity value for the package's contents. The implementation defines this value as a digest
-  that the packager computes from the package files it reads and redistributes. The algorithm is
-  documented and does not depend on any package manager.
+- an integrity value for the package's contents: a digest the packager computes from the package's
+  redistributed files.
+  - **Deterministic.** It covers exactly each redistributed file's normalized relative path within
+    the package and its bytes, combined in an order defined by the paths themselves.
+  - **Host-independent.** It excludes filesystem metadata, timestamps, ownership, permissions, and
+    the order in which files were extracted or listed. The same package contents always give the
+    same digest, wherever and however they were installed.
+  - **Documented.** The implementation defines and documents the exact algorithm, which does not
+    depend on any package manager.
 
 The packager uses a supplement only when all three match the package it is about to redistribute.