Retain source and output guards in native verification tasks

.github/readme-source.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "sha256": "822863534d7cc7a9531e96553b9087866095706c77325fd55f322404557fac9c",
+  "sha256": "e52e3bea7377b3e32bf78b79a478278dbf46eb14c05c454b8640def214a99d0c",
   "history": {
     "forbidden_commits": [
       "5e7eba20575e7194b6cb91a498f3a69d35e1e786"

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up development tools
-      uses: nicodes/tools/setup@7dd151b7c2cac851d46591cad4a14d74d923dd77
+      uses: nicodes/tools/setup@f7e243524ce2aa29f299e4c79db33001f72f4a30
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 5

.github/workflows/dependency-policy.yml

@@ -48,7 +48,7 @@ jobs:
       env:
         GH_TOKEN: ${{ github.token }}
       timeout-minutes: 7
-      uses: nicodes/tools/dependencies@7dd151b7c2cac851d46591cad4a14d74d923dd77
+      uses: nicodes/tools/dependencies@f7e243524ce2aa29f299e4c79db33001f72f4a30
       with:
         apply: 'true'
         output: ${{ runner.temp }}/dependency-report.json

README.md

@@ -1,4 +1,4 @@
-<!-- Generated from private documentation source. Do not edit directly. Source SHA256: 163f5e04e9b1f245566da8ab3ba06ad48e5ca750670fd34f7343c3b5f2943ac6 -->
+<!-- Generated from private documentation source. Do not edit directly. Source SHA256: 5e6b52c9ee9608c3a5544efbe25b3f0c9d0297d7876b052c419f9009fddc0c73 -->
 
 # fieldsofrevik-web
 
@@ -14,3 +14,14 @@ mise tasks ls            # Inspect tools and available commands
 ```
 
 Ctrl-C stops development. This website needs no runtime credentials or credential `.env` file.
+
+For contributor verification, prepare the pinned helper source before running native tasks:
+
+```sh
+git clone https://github.com/nicodes/tools.git .ci-tools
+git -C .ci-tools checkout --detach f7e243524ce2aa29f299e4c79db33001f72f4a30
+mise install
+mise run check
+```
+
+Build commands record source and exact regular output hashes. Declared tests produce evidence from the current verification session in `.artifacts/verification`.

mise.toml

@@ -4,15 +4,16 @@
 "node" = "24.18.1"
 
 [env]
-TOOLS_ROOT = "{{ get_env(name='TOOLS_ROOT', default=config_root ~ '/.ci-tools') }}"
-GOTOOLCHAIN = "local"
-PYTHONDONTWRITEBYTECODE = "1"
+"TOOLS_ROOT" = "{{ get_env(name='TOOLS_ROOT', default=config_root ~ '/.ci-tools') }}"
+"GOTOOLCHAIN" = "local"
+"PYTHONDONTWRITEBYTECODE" = "1"
 
 [tasks."install"]
 run = ["bun install --frozen-lockfile"]
 
 [tasks."build"]
-run = ["bun run build"]
+run = "python3 \"$TOOLS_ROOT/helpers/verification.py\" build --name build --artifact dist -- mise run _build"
+depends = ["install"]
 
 [tasks."artifact-check"]
 run = ["bash scripts/test-site.sh"]
@@ -26,3 +27,7 @@ run = ["bun -e 'const fs=require('\"'\"'node:fs'\"'\"');for(const p of ['\"'\"'d
 
 [tasks."check"]
 run = [{"task" = "install"}, {"task" = "build"}, {"task" = "artifact-check"}]
+
+[tasks."_build"]
+run = ["bun run build"]
+hide = true