chore(dev): add reproducible Node development bootstrap

.mise/config.toml

@@ -0,0 +1,29 @@
+min_version = "2026.10.13"
+
+[settings]
+# Fail closed against the lockfile: installs must match a locked platform
+# entry with its pinned checksum, and mise never rewrites .mise/mise.lock
+# implicitly (an un-reviewed lock change breaks the byte-identical approval
+# check used by the Courier bootstrap contract).
+locked = true
+
+[tools]
+node = "24"
+
+[tasks.bootstrap]
+description = "Idempotent dev bootstrap: npm ci + Prisma client generation (no DATABASE_URL, no migrations, no git hooks, no tests, no formatting)"
+run = [
+  "npm ci --include=dev",
+  "npx prisma generate",
+]
+
+[tasks.check]
+description = "CI-equivalent static checks: lint + typecheck (mirrors .github/workflows/ci.yaml)"
+run = [
+  "npm run lint",
+  "npm run typecheck",
+]
+
+[tasks.test]
+description = "Test suite: npm run test (vitest)"
+run = "npm run test"

AGENTS.md

@@ -15,6 +15,9 @@ Dispatch is a self-hosted Next.js/TypeScript Kanban and work dispatch layer for
 ## Key Commands
 
 ```bash
+mise run bootstrap   # Pinned Node + deps + Prisma client (idempotent; no DATABASE_URL, no migrations, no git hooks)
+mise run check       # Lint + typecheck (mirrors CI jobs)
+mise run test        # Vitest suite
 npm install          # Install dependencies (runs `prisma generate` via postinstall)
 npm run dev          # Start development server
 npm run build        # Production build
@@ -25,6 +28,11 @@ npm run db:push      # Push schema (dev)
 npm run db:deploy    # Deploy migrations (prod)
 ```
 
+`.mise/config.toml` + `.mise/mise.lock` are the repository development-bootstrap contract
+(Courier #414): Node is the pinned runtime tool, `bootstrap`/`check`/`test` are the shared task
+names, and `check`/`test` delegate to the authoritative `npm run` commands. Do not add
+git-hook installation, migrations, DATABASE_URL requirements, or test execution to `bootstrap`.
+
 ## Important Conventions
 
 ### Environment Variables

README.md

@@ -386,9 +386,25 @@ To enable OIDC authentication:
 
 ## Local Development
 
+Noninteractive bootstrap (recommended): [mise](https://mise.jdx.dev) reads `.mise/config.toml` and
+`.mise/mise.lock` — the config pins the supported Node range and the lockfile pins the exact
+version and download checksums, with `locked = true` so installs never deviate from or implicitly
+rewrite the lock. `mise run bootstrap` is idempotent — it installs the pinned toolchain, runs
+`npm ci`, and generates the Prisma client. It requires no `DATABASE_URL`, needs no sudo, runs no
+migrations, installs no Git hooks, mutates no global config, and does not run tests or formatting.
+The bootstrap needs `mise` on `PATH`; anything else it needs is declared in `.mise/`.
+
+```bash
+mise run bootstrap   # pinned Node + npm ci + Prisma client generation (repeatable)
+mise run check       # lint + typecheck (mirrors the CI jobs)
+mise run test        # vitest suite
+```
+
+Without mise, the equivalent manual steps are:
+
 ```bash
-# Install dependencies
-npm install
+# Install dependencies (Node >= 24; exact pinned version in .mise/mise.lock)
+npm ci --include=dev
 
 # Generate Prisma client
 npm run db:generate