Pinned
Commit identifiers and SHA-256 checksums prevent silent upstream changes.
Content integrity
Every layer should be traceable.
Quran Feham does not treat a provider name as sufficient provenance. A published content release records exactly what was used, when it was retrieved, how it was reviewed, and whether it may be redistributed.
Runtime Quran access is live; the immutable V2 content release is not yet bundled.
The reader currently fetches labelled Quran, translation, and recitation data from its configured provider and can reuse successfully cached responses. That working runtime path is not being presented as a reviewed redistributable release; whole-Quran morphology and tafsir remain unavailable until exact sources are licensed and validated.
Five distinct evidence layers
Keeping these layers separate prevents an explanatory note from looking like translation, or a third-party API response from becoming canonical silently.
- 1
Canonical Arabic
Immutable text release with riwayah, orthography, ayah numbering, and checksum.
- 2
Translation
A named translator and edition. Translation is never presented as the Quran itself.
- 3
Morphology
Exact analysis by surah, ayah, and word position. No prefix guessing or loose alias matching.
- 4
Recitation
A named reciter, recording edition, licence, and stable media source.
- 5
Tafsir and teaching
A specific work or reviewed note, visibly separated from translation and canonical text.
Reviewed
Published releases require a named reviewer and publication time.
Licensed
Redistribution and modification permissions are stored per source.
Minimum publication record
Each release records provider, edition, upstream version or commit, checksum, retrieval time, licence, included assets, review status, and reviewer identity.