Bundle E: the fact-model chain — nine rows in one land

.claude/rules/toolchain.md

@@ -215,7 +215,9 @@ mediating.
   hand-typed `/fast-forward` comment, naming the task to use instead. Decision
   table in `mise-tasks/gh-guard-check.sh`, gated by `mise run test:bats`. Reads
   (`gh pr view`/`list`/`create`, `gh pr ready`, `gh api`, `gh run view`) are not
-  blocked. Bypass: `BATTEN_GH_GUARD_BYPASS=1`.
+  blocked. Bypass: `BATTEN_GH_GUARD_BYPASS=1` — which since CLOUD-437 is the
+  `bypass_env` these rows DECLARE rather than the engine's global hatch, so
+  setting it now suppresses the `gh` lifecycle and nothing else.
 - **`memory-guard` is retired** (CLOUD-442), and what it denied is now the
   engine's protected-path gate: `.serena/memories/**` in `protected` crossed with
   the `[[verb]]` table, which covers the Write/Edit tools and a command's
@@ -225,7 +227,9 @@ mediating.
   names `rename_memory` — the only route that rewrites `mem:` referrers. The
   table in `batten.toml` is the one authority; the corpus that used to live in
   `tests/memory-guard.bats` is `crates/batten/tests/mediated_verbs.rs`. There is
-  no `BATTEN_MEMORY_GUARD_BYPASS`: a mediated deny takes the engine's own hatch.
+  no `BATTEN_MEMORY_GUARD_BYPASS`: a mediated deny takes the engine's own hatch,
+  `BATTEN_HOOK_BYPASS` — or the row's own `bypass_env` where it declares one
+  (CLOUD-437).
 - `policy-budget` gates AGENTS.md plus anything always-loaded against a token
   budget — what every agent pays every turn. It is `batten policy budget`, not a
   shell task: the counted set and both thresholds are `[budget.instructions]` in
@@ -363,7 +367,7 @@ call` with no `CLOUD-*` key **in that same paragraph** stops the lap. Two open
   are never judged, and a detached HEAD has no branch to key on — while an
   untracked-but-not-ignored file **is**, since opening a new feature file is the
   first edit this catches. There is no `BATTEN_CLAIM_GUARD_BYPASS`: a mediated
-  deny takes the engine's own hatch.
+  deny takes the engine's own hatch, `BATTEN_HOOK_BYPASS` (CLOUD-437).
 - **The three verdict-discarding shapes are the engine's** (CLOUD-443), as
   `batten.toml`'s `verdict-not-discarded` row — `kind = "pipeline"`. They are
   piping a verdict-bearing command into a pager or filter, following it with `;`

.serena/memories/core.md

@@ -704,6 +704,33 @@ repo config > default`, declared as data in `SETTINGS` (per-key env var/flag),
   surface would evaluate. Per-kind column agreement is a **census**
   (`Rule::columns` × `requires`/`permits`), not a per-kind match — the match
   named fields, so a new column landed in no arm and every kind accepted it.
+- `invocation.rs` — Rust call sites, parsed (CLOUD-914). Answers WHERE a token
+  sits, which no line predicate can: a literal in a call's ARGUMENT list is an
+  invocation argument, one in an array initialiser or a method call's receiver is
+  not, and a comment never reaches the walk at all. That split is the whole
+  discriminator — five of `git.rs`'s seven source-scan gates assemble their
+  needles by concatenation so they do not match their own source, and the two
+  that do not obfuscate are exactly the two that never read their own module.
+  A file the parser refuses is `Look::CouldNotLook`, never an empty node set.
+  Separate from `facts.rs` because that file forbids a wildcard match arm and the
+  walk over the parser's expression enum needs one — two matches with opposite
+  right answers do not share a file.
+- `uses.rs` — the `use` graph (CLOUD-762). Which module reaches which, resolved
+  through the crate root's own re-export table. **The measurement is the point:**
+  over `crates/batten/src/**` the syntactic tier diverges at exactly FOUR sites in
+  two classes, both re-exports — `trust.rs` and `output.rs` reach `error` through
+  `crate::UsageError` (a hidden edge a line predicate reads as nothing), and
+  `policy.rs` and `sink.rs` read as internal where `crate::Result` is really
+  `anyhow` (a phantom edge it invents). Aliases and globs move NO top-level edge
+  in this tree. Four is bounded and nameable, so the fact is `Read × Check` and
+  needs no delegated analyser — and the deeper reason is that the re-export table
+  is itself syntax, so a parser resolves it with no name resolution at all.
+  Two things the tree corrected and the code now states: a bare first segment at
+  the root is a module OR another crate, told apart only by the root's own `mod`
+  declarations; and `use crate::{a, b}` imports modules directly, so every
+  declared module is its own table entry. `via_root` marks the edges resolution
+  CHANGED, because judging by the item's case counts all 88 ordinary edges as
+  divergences.
 - `hook.rs` — the `hook` adjudicator (CLOUD-202): the normalized envelope, the
   wrapper-lookthrough command parser, the matcher, and the **per-host shims**
   (CLOUD-44). Five hosts plus the neutral `exit-code`: claude-code, cursor,

Cargo.toml

@@ -366,6 +366,37 @@ semver = "1"
 tar = "0.4"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+# Rust source parsed into a syntax tree, so a policy predicate can ask WHERE a
+# token sits rather than only whether it appears (CLOUD-914). `full` for
+# statement and expression syntax, `visit` for the read-only walk, `parsing` to
+# turn source text into that tree; `printing` and `proc-macro` stay off, because
+# nothing here emits Rust.
+#
+# ADOPTED RATHER THAN VENDORED ANEW: `syn` is already in `Cargo.lock` behind
+# every derive in the workspace (serde, schemars, clap, thiserror), so this adds
+# a direct edge and no new supply-chain surface. MIT OR Apache-2.0, already on
+# `deny.toml`'s allow-list.
+#
+# WHY NOT THE STRUCTURAL-MATCHER ROUTE: CLOUD-310 measured that route against
+# this tree and rejected it, on an upstream Rust API its own authors tier as
+# unstable and on grammars compiled by build scripts through a Darwin path this
+# repo has never exercised. Both defects it measured — extensionless files
+# scanning to nothing, and a shell grammar silently part-parsing `.bats` — are
+# properties of a shell corpus and do not reach `crates/**/*.rs`. A pure-Rust
+# parser with no build-script grammar is the ground that rejection left
+# standing, and `.claude/rules/scanning.md` names a CLASS for row two rather
+# than a product precisely so this substitution is following the rule.
+syn = { version = "2", default-features = false, features = [
+  "full",
+  "visit",
+  "parsing",
+  "clone-impls",
+] }
+# `span-locations` is what turns a span into a line number, and without it
+# `Span::start()` reports line 0 — a pointer-only finding whose pointer is a
+# constant. Already vendored beneath `syn`; this enables the feature and takes a
+# direct edge. Same license family, same allow-list.
+proc-macro2 = { version = "1", features = ["span-locations"] }
 # Finding-identity fingerprints (CLOUD-123): SHA-256 preimages, and NFC
 # canonicalization so macOS NFD checkouts fingerprint identically to Linux.
 #

batten.toml

@@ -215,6 +215,22 @@ sha256 = "b2c822742e8cbf355ba0cb4cc690c3cd8fdc9ec1916c8148f27bd9098cb7aee4"
 # `reason` is required on a shape rule, unlike on a file rule: a mediated deny
 # reaches a model as the entire explanation, so a refusal that named only its id
 # would be un-actionable (CLOUD-122). The crate appends the bypass hatch.
+# THESE FOUR WOULD DECLARE `bypass_env = "BATTEN_GH_GUARD_BYPASS"` AND DO NOT YET
+# (CLOUD-437, deferred to CLOUD-1027). They are the ported `gh-guard`, so that
+# name is TRUE of them where it was a fossil everywhere else, and declaring it
+# here is behaviour-PRESERVING: the same variable already suppressed these rows
+# back when it was the engine's global hatch.
+#
+# `config-lint` cannot see that argument. It compares `batten.toml` against
+# `origin/main` and reads a new `bypass_env` on a rule as `rule-predicate-changed`
+# — correctly, in its own terms, since the key makes a row suppressible. The
+# admissible route is a groomed `Weakens:` clause in the Ready block plus a
+# matching commit trailer, and CLOUD-437's block was groomed on 2026-08-14 without
+# one. Asserting it in the change that performs it is the exact shape §8 refuses.
+#
+# So until that row is groomed, these four take the general `BATTEN_HOOK_BYPASS`
+# like every other row. The column, the per-row lookup and the suppression all
+# ship; what waits is this repository's own use of them.
 [[rule]]
 id = "gh-pr-merge"
 kind = "shape"
@@ -1806,6 +1822,86 @@ severity = "deny"
 # bash, inside the bundle whose whole purpose is retiring bash (CLOUD-843 measured
 # "the bash grew today" as the campaign's own defect). Everything decided here
 # lives in two tracked TOML files, which is CLOUD-846's structured-config bucket.
+# Merged-ness is decided by patch identity, never by reachability (CLOUD-36),
+# migrated off a hand-rolled source scan (CLOUD-756).
+#
+# THE SCAN IS DELETED IN THE SAME CHANGE. `git.rs`'s
+# `no_ancestry_decides_merged_ness` is gone; a module landing beside a scan it
+# does not delete is two authorities on one property.
+#
+# `invocations` RATHER THAN `lines`, and this session measured why: the substring
+# scan fired four times on PROSE while CLOUD-914 and CLOUD-762 were being
+# written, at no call site at all. Porting it onto lines would have inherited
+# exactly that, obfuscated needles and all.
+[[rule]]
+id = "ancestry-decides-nothing"
+kind = "policy"
+scope = "tree"
+invocation_sources = ["crates/batten/src/*.rs"]
+module = "policy/ancestry-decides-nothing.rego"
+severity = "deny"
+
+# Module layering, over the resolved `use` graph (CLOUD-359).
+#
+# THE LAYERINGS WERE DOCUMENTED AND GATED BY NOTHING. `module-map-check` asserts
+# every module APPEARS in the map and says nothing about any edge — a membership
+# check standing in for a predicate, the same substitution `tests-not-deleted`
+# and `assertions-not-gutted` make. A back-edge compiled and passed every gate.
+#
+# `use_sources` RATHER THAN `line_sources`, and CLOUD-762 is why. A line
+# predicate over this tree is wrong at four measured sites: it cannot see the two
+# edges that reach `error` through a crate-root re-export, and it invents two
+# more where `crate::Result` is really `anyhow`. Both surfaces cost the same
+# parse; only one is right, so shipping the other would be a known false green.
+#
+# A GLOB RATHER THAN A LIST, for `line_sources`' own stated reason: an enumerated
+# set goes stale the next time somebody adds a module, silently and green, which
+# is the failure the declaration bound exists to prevent.
+# CLOUD-882. `[workspace.dependencies]` fixes a version; it does not add a
+# dependency. An entry no member references with `<key>.workspace = true`
+# resolves to nothing, so every gate reading the RESOLVED graph is green about a
+# crate that is not in the tree. Measured: `orphan-probe = "=9.9.9"` -- a crate
+# that does not exist, at a version that does not exist -- passed `cargo
+# metadata`, `macos-link-check` and `deny`, four greens over nothing.
+#
+# `sources` RATHER THAN `documents`, because only `sources` is glob-selected
+# (CLOUD-850) and the member set is a glob by nature: a crate added tomorrow is
+# judged without anyone editing this row, which is the property an enumerated
+# list loses silently.
+# CLOUD-614. A `command` row's `check` is spawned with the checked tree as its
+# working directory, so `mise run <task>` resolves from THERE. A row naming a
+# task the tree does not define does not fail to launch — the runner is on PATH,
+# it starts, exits non-zero, and the engine reports a finding at the row's own
+# severity about a tree it never inspected. Measured as a `deny` asserting
+# NTIA-nonconformance over a scratch tree carrying nothing but a lockfile.
+#
+# THE CLAUSE LIVES HERE RATHER THAN IN `config-lint` because a task runner is a
+# consumer's choice: `no_artifact_name_reaches_the_core` refuses the engine
+# learning this manifest's name (non-negotiable rule 1).
+[[rule]]
+id = "command-task-defined"
+kind = "policy"
+scope = "tree"
+sources = ["batten.toml", "mise.toml"]
+module = "policy/command-task-defined.rego"
+severity = "deny"
+
+[[rule]]
+id = "workspace-dep-referenced"
+kind = "policy"
+scope = "tree"
+sources = ["Cargo.toml", "crates/*/Cargo.toml"]
+module = "policy/workspace-dep-referenced.rego"
+severity = "deny"
+
+[[rule]]
+id = "module-layering"
+kind = "policy"
+scope = "tree"
+use_sources = ["crates/batten/src/*.rs"]
+module = "policy/module-layering.rego"
+severity = "deny"
+
 [[rule]]
 id = "opa-tracks-regorus-compliance"
 kind = "policy"

crates/batten/Cargo.toml

@@ -100,6 +100,8 @@ semver.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 sha2.workspace = true
+proc-macro2.workspace = true
+syn.workspace = true
 tar.workspace = true
 toml.workspace = true
 unicode-normalization.workspace = true

crates/batten/src/baseline.rs

@@ -28,13 +28,25 @@
 //! The issue asks that "the baselined state must be an ancestor of the
 //! authoritative ref at its currently-fetched SHA". That claim cannot be spelled
 //! as ancestry in this crate, and the refusal is a compiled one:
-//! `git::tests::no_ancestry_decides_merged_ness` scans every `src/*.rs` file —
+//! `policy/ancestry-decides-nothing.rego` judges every `src/*.rs` file —
 //! including `git.rs` itself, and including this module — for the whole
-//! reachability-answer vocabulary, which is why the tokens are named nowhere in
-//! this file. (It caught this paragraph's first draft, which spelled them out to
-//! explain them. A gate that exempted the prose describing it would be a gate
-//! with a hole shaped exactly like a comment.) Merged-ness is decided by **patch
-//! identity**, because a rebased or squashed landing is invisible to ancestry
+//! reachability-answer vocabulary IN COMMAND POSITION.
+//!
+//! This paragraph used to end differently, and the change is worth recording
+//! rather than quietly making. It read: *"a gate that exempted the prose
+//! describing it would be a gate with a hole shaped exactly like a comment"* —
+//! written after the old substring scan caught this very paragraph's first
+//! draft. That argument is real but it proves less than it claims: a comment
+//! cannot decide merged-ness, because it is not executed, so exempting prose
+//! opens no hole in the property the gate NAMES. What the broad reading actually
+//! bought was a stronger, unstated rule — keep the vocabulary out of the crate
+//! entirely — and the price was measured in one session: four false positives on
+//! prose written while implementing CLOUD-914 and CLOUD-762, each "fixed" by
+//! rewording English until the scanner stopped noticing.
+//!
+//! So the tokens may now be named in prose and may not be passed to git.
+//! Merged-ness is decided by **patch identity**, because a rebased or squashed
+//! landing is invisible to ancestry
 //! and these repositories land by fast-forward, where a landed branch is an
 //! ancestor of nothing.
 //!

crates/batten/src/config.rs

@@ -1007,6 +1007,7 @@ fn default_rules() -> Vec<Rule> {
         requires_key: None,
         reason: None,
         policy_url: None,
+        bypass_env: None,
         check: None,
         fix: None,
         produces: None,
@@ -1033,6 +1034,10 @@ fn default_rules() -> Vec<Rule> {
         sources: Vec::new(),
         lines: Vec::new(),
         line_sources: Vec::new(),
+        invocations: Vec::new(),
+        invocation_sources: Vec::new(),
+        uses: Vec::new(),
+        use_sources: Vec::new(),
         predicate_severity: None,
         no_fix_reason: None,
         checks: None,