Stack

Every executable version is declared once, and a wrong artifact fails at check time rather than surfacing later as a difference between machines.

Pinned executables

ToolVersionWhy
uv0.12.7Python packaging and the interpreter itself, installed from the vendor's own release artifact.
bun1.4.2The JavaScript runtime and package manager. No Node is pinned, and none is needed.
gh2.101.0Every GitHub operation, reached through the tooling package rather than typed by hand.
mise2026.9.9The task runner. Every project operation is a task, on every environment.

toolchain.json is the one declaration of executable versions: each entry is the vendor's own release artifact for both aarch64-darwin and x86_64-linux, with the sha256 that release published. nix flake check builds every tool, runs it, and asserts the version it reports equals that file, so a wrong artifact fails at check time rather than surfacing later as a confusing difference between machines.

Runtime

Site
Astro 7.3.3 with React islands, static output, built by bun.
Pipeline
Python 3.13.15, PyTorch Geometric for the graph models, PyKEEN for the embedding rungs.
Gates
ruff, strict mypy on both platforms, pytest, typos, zizmor.
Environments
This laptop, GitHub Actions, and Lightning AI. Nix on the laptop; MISE_ENV=ood where Nix is not available.