docs(verification): what counts as a board, as tracked repo doctrine

[cryptskii]

Docs only. One new file, no code.

Why

A security change was verified with cargo test --lib, reported as a green board, and merged on that report. 15 of 51 integration suites were broken and main went red. --lib neither compiles nor runs tests/*.rs, so no command that was run could have surfaced those failures.

CI was never the problem — ci.yml has run the full workspace command all along. What failed was local verification doctrine, and the only place it was written down was a gitignored, machine-local agent config. This puts it where fresh clones and CI can see it.

Contents

Each rule is a specific thing that went wrong, not a general aspiration:

• The board is the exact CI command. --lib is disqualified by name, with the ~51 integration binaries it skips spelled out.
• A board has two halves. make lint exists only at the repo root; running it elsewhere reports No rule to make target 'lint', which is a missing target, not a passing lint. Read the output, not just the exit code. (This bit during the R_econ work.)
• Never tail a board. Truncation discards the failure names and forces a re-run for information the first run already produced. Grep for real failure lines — passing tests routinely log the word FAILED in their own output.
• Name crates and counts. And: a board that finished before your last edit does not describe the tree you are pushing. Re-run or discard it; "provably behaviour-free" is the argument that produces stale-green reports.
• A capability removal owes a dependent sweep. A consequence written in prose is a test obligation, not a disclaimer. Fixtures are the usual dependents and exactly what --lib hides.
• Enabling a previously-unenabled cargo feature is a build-graph change that can wake never-compiled, never-linted code.
• Mutation-test every security gate — and read the result correctly: positive-control that the mutation edit actually landed, and treat a mutation that stays green as a finding about the gate or the test, never as a pass.

Location

Force-added, because .github/instructions/ is itself ignored and every existing instruction doc there is tracked the same way — this follows the directory's established pattern.

CLAUDE.md was deliberately not force-added. Its ignore entry sits in a standing "agent config stays local" group alongside AGENTS.md, .cursor/, .clinerules/ and skills/, and overriding it would turn a local agent file into repository policy by accident. The local copy remains for convenience; this file is authoritative.