# Verification

All ordinary repository commands are offline and select exactly the Go 1.26.5
toolchain that launched the quality gate. `make fast` is the affected feedback
loop, `make check` adds formatting, module/vendor, Protobuf, architecture, vet,
and shuffled tests, and `make verify` adds lint/NilAway, security, race, fuzz,
coverage, and vendor-only build proof.

A fresh machine runs `make tools-bootstrap` once. This is the sole
network-authorized quality-gate mode. It copies each `go.mod`/`go.sum` pair to a
temporary modfile, downloads the exact graph from the public Go proxy with
credentials and private-module environment removed, and verifies that no
repository byte changed. It does not tidy, vendor, generate, or install into the
repository.

`make proto` regenerates committed `common/v1` and `engine/v1` Go from local
tool directives. `make check` runs Buf lint, compares schemas with the committed
FILE-level `schema-baseline`, regenerates into a temporary directory using the
exact selected Go binary, and rejects any byte difference. There are no remote
Buf plugins or normal network fallbacks.

Generated `*.pb.go` and canonical Spice output remain compilation, test, race,
security, and offline-build inputs. They are excluded only from handwritten
formatting and coverage-denominator checks because their source schemas and
deterministic freshness are separately enforced.