feat(record): declare a verb-written family, and retire the first of the nine it unblocks

.github/workflows/branch-hygiene.yml

@@ -9,7 +9,8 @@ name: branch-hygiene
 # Failure here is informational: it means branches are accumulating, not that
 # anything is broken. `land` deletes the head of a PR it merges, so a growing
 # list means branches abandoned without landing, or names reused across stories.
-# Run `mise run branch-age-check` locally and delete what has landed.
+# Run `mise run branch-age-record` locally, then `batten check --rule 'branch
+# watch loose'`, and delete what has landed.
 
 on:
   schedule:
@@ -53,7 +54,13 @@ jobs:
           # the reason ci.yml states: the whole toolchain is ~10s a job that
           # this one has no use for.
           install_args: aqua:cli/cli aqua:jqlang/jq
-      - run: mise run branch-age-check
+      # THE SPLIT THE PORT FORCED (CLOUD-1717). The producer makes the two
+      # `gh` reads and the calendar subtraction; the engine adjudicates what
+      # it recorded. Neither half can hold the other: section 5 makes `check`
+      # `read` and incapable of spawning, and the engine calls no clock on any
+      # evaluation path.
+      - run: mise run branch-age-record
+      - run: mise run batten -- check --rule 'branch watch loose'
       # The landing lease is a ref, so its hygiene belongs in the ref sweep
       # rather than in a cron of its own — that is the whole reason it lands
       # here: an added step on a job that already spins costs no runner.

.github/workflows/land-divergence.yml

@@ -17,8 +17,10 @@ name: land-divergence
 # truncated rather than merely stale.
 #
 # THIS MUST NOT RUN IN THE GATE OR IN `verify`. It is a property of the world,
-# and a property of the world must not red a branch — `tests/land-divergence.bats`
-# asserts its absence from both.
+# and a property of the world must not red a branch. Two things hold that now
+# (CLOUD-1717): the producer below is in no gate list, and the row that replaced
+# the decider is `severity = "warn"`, so `lane grade other` reports without
+# failing any run that does not ask it to. This job is the one caller that asks.
 
 on:
   schedule:
@@ -74,7 +76,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           BATTEN_DIVERGENCE_SINCE: ${{ inputs.since }}
-        run: mise run land-divergence > "$RUNNER_TEMP/divergence.txt"
+        run: mise run land-divergence-record > "$RUNNER_TEMP/divergence.txt"
       - name: Publish the records
         shell: bash
         run: |
@@ -88,7 +90,13 @@ jobs:
       # Always, so the records above are published even when a budget is broken —
       # the number is the point, and a summary that only appears on green is a
       # report nobody reads at the moment it matters.
+      # `--fail-on-warning` IS WHAT KEEPS THE GATE A GATE. The row is
+      # `severity = "warn"` so that every `check` and every `verify` stays green
+      # over a property of the fleet no branch causes. This job is the one reader
+      # that must red on it, which is the retired decider's posture exactly: a
+      # number that rises has to fail something or it becomes another artifact
+      # nobody opens.
       - name: Judge the divergence against its budgets
         if: always()
         shell: bash
-        run: mise run land-divergence-assert < "$RUNNER_TEMP/divergence.txt"
+        run: mise run batten -- check --rule 'lane grade other' --fail-on-warning

.github/workflows/nonverdict-rate.yml

@@ -20,8 +20,9 @@ name: nonverdict-rate
 # THIS MUST NOT RUN IN THE GATE OR IN `verify`. It is a property of the world, and
 # a branch must not go red because the platform had a bad afternoon —
 # coverage.yml:15-18 states the same boundary for the same reason. What IS gated is
-# the decision: `tests/nonverdict-assert.bats` runs on every commit, because the
-# decider is a pure function of records.
+# the decision: `crates/batten/tests/it/nonverdict.rs` and
+# `policy/nonverdict.rego`'s own cases run on every commit, because the decider
+# is a pure function of records.
 #
 # Failure here is informational: it means the rate crossed its budget and wants
 # looking at, not that anything in the tree is broken. Nothing here writes to the
@@ -73,11 +74,16 @@ jobs:
       # GH_TOKEN through env, never interpolated into the run block: a `${{ }}`
       # expansion is textual substitution into the shell script, which zizmor gates
       # at high severity.
+      # THE SPLIT THE PORT FORCED (CLOUD-1717). The producer makes the
+      # conditional `gh` reads and classifies each failed job from its own
+      # per-step conclusions; the engine adjudicates what it recorded. Neither
+      # half can hold the other: section 5 makes `check` `read` and incapable of
+      # spawning the reads below.
       - name: Measure which required-check failures never reached a verdict
         shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mise run nonverdict-scan > "$RUNNER_TEMP/nonverdict.txt"
+        run: mise run nonverdict-record > "$RUNNER_TEMP/nonverdict.txt"
       - name: Publish the records
         shell: bash
         run: |
@@ -91,7 +97,14 @@ jobs:
       # Always, so the records above are published even when the budget is broken —
       # the number is the point, and a summary that only appears on green is a
       # report nobody reads at the moment it matters.
+      # `--fail-on-warning` IS WHAT KEEPS THE GATE A GATE. The row is
+      # `severity = "warn"` so that an ordinary `check` — and therefore every
+      # `verify` and every branch — stays green over a property of the runner
+      # fleet no branch causes. This job is the one reader that must red on it,
+      # which is the posture the retired decider had and the reason it exists:
+      # "a rate that rises has to fail something, or it becomes another artifact
+      # nobody opens".
       - name: Judge the rate against its budget
         if: always()
         shell: bash
-        run: mise run nonverdict-assert < "$RUNNER_TEMP/nonverdict.txt"
+        run: mise run batten -- check --rule 'job grade other' --fail-on-warning

.github/workflows/release-assets.yml

@@ -127,9 +127,20 @@ jobs:
       # offering the feature at all, and the task exits 0 having judged no
       # artifact. It starts verifying on its own the moment CLOUD-585 makes the
       # repository public, with no edit here.
-      - name: Check the release's binaries carry build provenance
+      #
+      # THE SPLIT THE PORT FORCED (CLOUD-1717), and this caller is what CLOUD-1833
+      # was filed for. `attestation-check` was one program making the probe and
+      # adjudicating it; section 5 makes `check` `read` and incapable of spawning,
+      # so the `gh` reads are the producer's and the verdict is the engine's. The
+      # step above went on calling the deleted task for as long as nothing asked
+      # whether a workflow's callers still resolve — `workflow run unknown` is
+      # that clause, and it reported this line.
+      - name: Record the platform's attestation posture and each archive's verdict
         shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ inputs.tag }}
-        run: mise run attestation-check "$TAG"
+        run: mise run attestation-record -- "$TAG"
+      - name: Check the release's binaries carry build provenance
+        shell: bash
+        run: mise run batten -- check --rule 'release grade unsafe'

.github/workflows/timeout-drift.yml

@@ -66,8 +66,21 @@ jobs:
       # `${{ }}` expansion is textual substitution into the shell script, and
       # zizmor gates that at high severity. All logic is in the task; nothing
       # here but the invocation.
-      - name: Report budgets that no longer match their measurement
+      # THE SPLIT THE PORT FORCED (CLOUD-1717), and the shape `branch-hygiene.yml`
+      # takes: the producer makes the forge reads, the engine adjudicates what it
+      # recorded. Neither half can hold the other — section 5 makes `check` `read`
+      # and incapable of spawning, and the engine calls no clock on any evaluation
+      # path.
+      #
+      # `--fail-on-warning` because `bound grade other` is declared `warn`: a
+      # budget drifting is a report about the world rather than a verdict on a
+      # branch, and this scheduled job is the one caller that should still go red
+      # for it.
+      - name: Record each job's measured duration against its declared budget
         shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: mise run timeout-drift
+        run: mise run timeout-drift-record
+      - name: Report budgets that no longer match their measurement
+        shell: bash
+        run: mise run batten -- check --rule 'bound grade other' --fail-on-warning

.serena/memories/core.md

@@ -2448,6 +2448,73 @@ judge_fingerprint`, its own domain tag), so a caller can reference content it
   appearing after the record moves the key instead of being invisible. Every
   failure is could-not-look, which allows; a fact naming every program in a
   project must never refuse on a failure to see.
+- `signer_posture.rs` — whether a git signing configuration names a key anyone
+  can verify (CLOUD-669, CLOUD-1717). NOT AN ARGUMENT AGAINST SIGNING: signing
+  in CI with a published public half is the desired end state and CLOUD-591 owns
+  getting there. What this names is narrower — a signature from a key that
+  cannot be verified or reproduced, which is WORSE than no signature because it
+  looks like provenance and carries none. Two measured conditions: a
+  `gpg.ssh.program` under `/tmp`, which the container reclaims, and a
+  `user.signingkey` naming a file that is empty, unreadable, absent or a
+  DIRECTORY. Four file tests rather than one, because a size test alone calls a
+  directory healthy — a measured defect, not thoroughness. A literal inline key
+  is not a path and is the most publishable form there is, so it short-circuits
+  before any file test; the `/tmp` test outranks everything, because a reclaimed
+  signer breaks verification whatever the key is. It also owns the RECORD'S
+  SHAPE, including truncating each sha to eight characters — the difference
+  between a pointer and a payload (rule 4) — which was a sequence of `printf`
+  calls in a task body that nothing tested. It reaches NOTHING and never runs
+  `git config`: the two values arrive as `&str`, which keeps the reading
+  testable against a scratch path and a developer's real configuration out of
+  the tests. Ported off `mise-tasks/signing-posture.sh`; `signing-posture-repair`
+  no longer classifies a second time but reads the posture off the record the
+  producer just wrote. **It never passed through a `.py`, whatever this entry
+  said first**: that sibling was created and deleted inside the same branch, so
+  naming it here recorded branch-internal churn as provenance. The detour is
+  real and belongs on `shell-retirement.rego`'s arm F, which now refuses it —
+  not in the module's own history.
+- `cargo_graph.rs` — the ACTIVATED dependency graph, read from a `cargo metadata`
+  document (CLOUD-1717). ONE WALK, TWO GATES, and that is the whole reason it
+  exists: `evaluator-closure` asks whether an IO-bearing crate is reachable from
+  one package's node, `macos-link` whether anything built needs a platform SDK to
+  link; the questions differ only in their ROOTS and in what they look for once
+  there. Both programs carried their own copy and both headers said so in prose —
+  _"if one is corrected, correct both"_ — which is a rule with no mechanism, and
+  this is the mechanism. THE ACTIVATION FILTER, never the whole resolve: `cargo
+metadata` lists every package the resolver CONSIDERED, so scanning it asks
+  "could some configuration reach X" where both callers mean "does this one".
+  Reverting that is the measured defect — an unactivated optional dependency
+  reaching no framework and never compiled made the link gate refuse a link
+  `darwin-link` then completed on the same tree. Three rules live here and
+  nowhere else: an optional dep is an edge only if activated; the weak form
+  `foo?/bar` is NOT an activation; a `dev`-only edge is dropped unless its owner
+  is a workspace member. A fourth is the fail-safe: an edge the manifest does not
+  explain is KEPT, because unexplained means unmeasured. NO CRATE NAME REACHES
+  IT — which package is the evaluator, which bear IO, which need an SDK and which
+  vendor what they link are consumer facts in `[[pattern]]` rows (rule 1), so
+  roots are chosen by a PREDICATE the caller supplies. Ported off
+  `mise-tasks/evaluator-closure-check.sh` and `macos-link-check.sh`, the two
+  callers that each carried a copy of the walk; carries the three `#MUTANT`
+  rows that used to be stated twice, now stated once over the code they mutate.
+  A `cargo_graph.py` sibling existed for part of that branch and never reached
+  `main` — the detour belongs to `shell-retirement.rego`'s arm F, not here.
+- `probe_verdict.rs` — which of three things a probe build did, from its exit
+  status and its log (CLOUD-418, CLOUD-1717). THE VERDICT IS THE HARNESS'S OWN
+  LINE, NEVER THE EXIT CODE ALONE: `cargo test` exits non-zero for a compile
+  error, an unresolved feature, an absent toolchain and a panic in some other
+  test, every one of which would read as "the probe falsified the assertion" and
+  hand the gate a pass it did not earn — and that pass gets MORE likely as the
+  crate breaks, so a gate written to the obvious shape is loudest exactly when it
+  is lying. Anchored on the `failures:` listing rather than the per-test line,
+  which is not stable across `--quiet`. It reaches NOTHING, not even `error`:
+  one total function to a three-valued enum, where a log it cannot make sense of
+  is `Unread` — the could-not-look the caller already handles, so a `Result`
+  would add a state with no distinct handling. Ported off
+  `mise-tasks/evaluator-io-check.sh`. A `probe_verdict.py` sibling stood between
+  the two for part of that branch and never reached `main`: that was the
+  campaign to delete bash routing a reading into another interpreter, and
+  `shell-retirement.rego`'s arm F now refuses the shape. Its caller is `record derive`, which SPAWNS NOTHING — the probe
+  build stays in the producer task (§5) and the log arrives on stdin.
 - `prune.rs` — the build tree's reclaim and its disk floor (CLOUD-766/861/1030),
   retired out of `mise-tasks/target-prune.sh` under CLOUD-1059.
   `Effect::Destructive` on `Surface::VerifyOnly`, beside `capture prune` — §5's