# Task 03: reproducible inputs, patches, and provenance

## Deliverable

Unify source archives, build-tool wheels, native dependencies, and package
patches under verified acquisition. No release artifact may depend on an
unpinned `pip install setuptools wheel ...` result.

Define a visible patch layout. A patch records package/version, upstream source
hash, reason, target fact being substituted, and a test. Patch application must
fail on drift rather than fuzzily succeeding against another source version.

Record enough provenance in build output or adjacent index metadata to answer:

- which source hash produced this wheel;
- which build tools and target libraries were used;
- which ABI ID and recipe revision were used;
- which patches were applied.

## Exit gate

- Offline rebuild succeeds from a populated verified cache.
- A changed hash, unpinned build tool, or drifting patch fails before compile.
- Two identical clean builds produce equivalent wheel contents, allowing only
  explicitly documented archive timestamp normalization until deterministic
  ZIP output is implemented.