The "verify once": approve every used primitive at its current content hash, returning the new baseline.
The "verify once": approve every used primitive at its current content hash, returning the new baseline.