# Workflow: reproduce and vote

Goal: strengthen a package's trust by independently reproducing its build and
reporting the result. This is the heart of `reproducibility-as-trust`.

1. **Pick a target.** A package at `single` trust benefits most. Check:
   ```
   curl 'https://solnix.io/api/v1/packages/<attr>/attestations'
   ```
2. **Reproduce it** on your own builder: same recipe, same pinned inputs,
   sandboxed, same platform tuple. Compute the output NAR hash.
3. **Report your hash** (attestation). If it matches the published artifact, the
   package moves toward `reproduced` → `verified` (a quorum of independent,
   identical hashes).
4. **If your hash differs**, that's a `disputed` signal — valuable. Capture the
   diff (what inputs/toolchain/flags you used), and raise it on `hackers@` so the
   non-determinism can be found and fixed. A disputed artifact should not be
   trusted until resolved.
5. **Vote on patches** the same spirit: `+1/0/-1` on `hackers@`. Remember human
   review and the reproducibility quorum are **separate** gates — your reproduction
   is the second, not a substitute for the first.

The point: trust is earned by math (independent identical hashes), not by
authority. Your reproduction is a first-class contribution.