docs(scope): a boundary that survives the roadmap, and the misuse cost named (CLOUD-198)

[wenzowski]

What

Closes the last two README residuals from the alignment audit's weak-case register (CLOUD-198):

• W11 — the Scope-and-limits negation ("not a general-purpose hook runner, file-shape linter, secret scanner…") was contradicted by the only shipped rule kind and by three roadmap issues adding exactly those categories. Restated as a boundary that holds while rule kinds grow: batten evaluates narrow content predicates and wraps tools as evidence sources — a rule kind gates on a tool's verdict, never replaces the tool. "Wrong entity" is sharpened to a call's argument values judged against committed, out-of-band config, matching the amended specs.
• Misuse disclaimer — a green check certifies exactly its predicates, nothing more; the over-trust cost is now named in the one file consumers read, not only in the Linear design record.
• Retires the tests/cli.rs doc-comment dating the hook inversion to an unlanded issue (the hook_* tests exercise it since feat(hook): the adjudicator's first slice — envelope, parser, gh policy (CLOUD-202) #113).

Verification

• Docs + one comment change; mise run verify green on the rebased head (full gate incl. batten-check); behavioural suite unchanged and passing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VS5eTnMTruCWytpAk2gW7k

[linear-code]

CLOUD-198 Truth reconciliation: every committed claim is true or marked planned

The 2026-08-07 alignment audit found 44 places where a committed artifact contradicts a spec commitment or a shipped doc describes behaviour that does not exist (see project document Alignment audit 2026-08-07 — Conflict & divergence register). This issue tracks the mechanical subset: make each claim true, or rewrite it as a plan pointing at its issue. No feature work.

Scope (register numbers in parentheses):

• Wire consumer ci: check in the main-branch protection ruleset #1: ~~batten-check~~ hk step + mise task + behavioural test (23) — landed with this branch's first commit, Refs CLOUD-71
• Bare invocation lists subcommands, exit 2, non-empty output + test (2)
• README: exit table 70→3 (1); setup block mise install && mise run ci + CONTRIBUTING link (26); zero-config/init/doctor bullet rewritten as roadmap with issue keys (21); status note states the crate is not yet published (19, per the distribution deferral decision)
• batten.example.toml: commented [[rule]] example + strictness-floor note (10, 11)
• CHANGELOG: hand-written body removed — release-plz owns the file; the body claims a dual MIT/Apache license that does not exist (18)
• Cargo.toml: trim keywords to shipped capabilities (20)
• AGENTS.md: guard count → pointer to .claude/settings.json (25); In-Review map aligned to DoR/DoD (31); exit-contract non-negotiable inserted so DoR's "rules 2, 3, 4, 5" citation resolves (27)
• .claude/rules/rust.md: stale "empty tree" layout block deleted (30); CONTRIBUTING cross-check/darwin-link note (28)
• mem:toolchain-and-hooks: context-budget default 6000→3500 (29)
• severity.rs module doc: "authored in batten.toml" corrected to "not yet on Rule (CLOUD-61)" (12)

Ready

• Source of truth: the conflict register document; each bullet names its register finding.
• Gate: mise run verify green on the branch; the new behavioural tests (bare invocation, committed-config) pass under mise run test:cargo; prose edits carry no new claims without an issue key.
• Done when: every bullet's file no longer contradicts its register finding, landed on main by fast-forward, CI green.

Review in Linear

[wenzowski]

/fast-forward