Complete the Notarius feature

docs/conventions.md

@@ -44,6 +44,11 @@
   the role's own implementation. Put implementation verification in
   repository-local tests unless the specification explicitly requires runtime
   validation during convergence.
+- For an unavoidable `command` or `shell` task, declare the operation's change
+  semantics as required by ansible-lint. A conditionally executed mutation may
+  use `changed_when: true`; a read-only command should use
+  `changed_when: false`. This describes an imperative operation and does not
+  replace the idempotence of a state-management module.
 - Apply `become: true` to individual tasks that require elevated privileges.
   Do not require callers to escalate an entire play merely to use a role.
 - Complexity requires a requirement. Every additional task, conditional,