feat(s033): complete slice 033 (AGENTS.md project context)

PROOF.md with every criterion's evidence by test name against run
35551683298 (gate, postgres and fips green). NOTES.md: five findings,
three follow-ups. ROADMAP row 033 to done; coverage.tsv row 78.50 %.

Signed-off-by: Ayla Croft <aylacroft@proton.me>

Author: HackTuah

ROADMAP.md

@@ -47,7 +47,7 @@ standards register names the rows that ask for them.
 | 030 | Persona (SOUL) + always-on memory tier | 3 Memory | M | 012 | approved |
 | 031 | Session search (SQLite FTS5) | 3 Memory | S | 010 | approved |
 | 032 | Embeddings + semantic memory + hybrid retrieval | 3 Memory | L | 031 | planned |
-| 033 | Project context: AGENTS.md | 3 Memory | S | 030, 022 | in_progress |
+| 033 | Project context: AGENTS.md | 3 Memory | S | 030, 022 | done |
 | 034 | Export, import, restore | 3 Memory | S | 030, 031 | planned |
 | 040 | Skills registry + agentskills.io format + progressive disclosure | 4 Skills | M | 020 | planned |
 | 041 | Skill self-management with staged approval + scanner | 4 Skills | M | 040, 021 | planned |

coverage.tsv

@@ -13,3 +13,4 @@ slice_id	percent	sha	date
 024	76.55	f977b84	2026-09-20
 031	76.96	866dc3f	2026-09-20
 030	78.40	c657da8	2026-09-21
+033	78.50	3b5e89e	2026-09-21

slices/033-project-context-agents-md/NOTES.md

@@ -46,3 +46,23 @@ Manual verification queue: none; every criterion is `[auto]`.
 Deviations stated before any code: (a) the context tier's budget changes from 300 to 5,800 tokens for the
 measured reason above; (b) "project root(s)" is one root per session at this slice (the column is one string);
 several roots is a follow-up until a slice needs it.
+
+## Findings, 2026-09-21
+
+1. **The context tier had no room.** 030 left it at 300 tokens; this tree's own `CLAUDE.md` is 2,849. The
+   measured budget (5,800) and the cap (16,384 bytes) are in the section above, and the arrangement mirrors
+   030's volatile tier: the cap binds first and states its cut; the tier receipt is the backstop.
+2. **`AGENTS.md` is read every turn, not cached.** A stat-and-read per turn is cheaper than a watcher and is
+   what "live reload" means here: the test edits the file between two turns and the second prompt carries the
+   new text.
+3. **AC3 is true by construction and proven end to end anyway**: the gate reads arguments, names and rules, never
+   the prompt; the hostile fixture's text reaches the model inside its untrusted block and the write still asks.
+4. **sobelow on the read**: the path is the owner's root plus a constant; skipped inline with the reason.
+5. **The working directory is the root at this slice.** `discover/2` takes a `cwd` under the root (the nested
+   fixture's test uses it); the Session passes the root for both until a slice gives a session a working
+   directory of its own below its root (the shell tool's `cd` is per call, not per session).
+
+## Follow-ups
+- 040: the skills index joins the context tier; skill discovery reads `project_root` (this slice's setting).
+- Several project roots per session (deviation b) when a slice needs it.
+- A session working directory below the root (finding 5) when the shell gains a persistent cwd.

slices/033-project-context-agents-md/PROOF.md

@@ -0,0 +1,97 @@
+# Proof for slice 033: Project context: AGENTS.md
+
+Agent: Trinity · Coding Agent · Date: 2026-09-21 · Branch: slice/033-project-context-agents-md · Final commit: (the commit carrying this file; named in the closing correction)
+
+## Summary
+The session's project root as a setting (a column, a setter, a field in the chat's bar) that the tools' working
+directory follows; `Trinity.Context.AgentsMd`, which reads every `AGENTS.md` from the root to the working
+directory, outermost first, caps the total at 16,384 bytes keeping the nearest whole and stating every cut, and
+renders each inside an untrusted block with its digest; the prompt's context tier fed every turn (live reload)
+with its budget raised from 300 to 5,800 tokens on measurement. Five findings in NOTES.md.
+
+## Gate
+```
+$ mix gate                                   (this machine, OTP 28.5.0.5, Elixir 1.20.4, under a 32 GiB cgroup, tree 3b5e89e)
+1605 mods/funs, found no issues.
+... SCAN COMPLETE ...
+No retired or security advisory packages found
+No vulnerabilities found.
+Result: 357 passed, 17 excluded
+trinity.coverage: 030 78.4% vs 031 76.96%: OK
+plan_check: PASS
+exit=0
+```
+CI, run 35551683298 on the tree at 3b5e89e: `gate` success (357 passed, 17 excluded), `postgres` success
+(349 passed, 25 excluded), `fips-tag` and `fips` success.
+
+## Tests
+```
+$ mix test --cover                           (tree 3b5e89e)
+Result: 357 passed, 17 excluded
+|     87.50% | Trinity.Context.AgentsMd               |
+|     78.50% | Total                                  |
+```
+`coverage.tsv` row: `033  78.50  3b5e89e  2026-09-21` (from 78.40 at 030).
+
+The slice's seven tests (`--trace`):
+```
+* test the field saves an existing directory, refuses a missing one, and clears on empty [L#13]
+  * test the field saves an existing directory, refuses a missing one, and clears on empty (99.9ms) [L#13]
+  * test live reload: a change to AGENTS.md between two turns is in the second turn's prompt (11018.7ms) [L#89]
+  * test AC3: an AGENTS.md that says approvals are disabled changes nothing at the gate: a write still asks (6021.7ms) [L#109]
+  * test AC2 (precedence): nested files load outermost first and the block says the nearest wins; the working directory decides which are on the path (1.2ms) [L#44]
+  * test the session's project root: set from an existing directory, cleared with nil, refused otherwise; the tools' cwd follows it (5.1ms) [L#78]
+  * test AC2 (cap): over the cap the nearest file stays whole, the outer one is cut, and the cut states the file and the bytes (0.3ms) [L#62]
+  * test AC1: a repository with AGENTS.md puts its content in the prompt's context tier inside an untrusted block with its digest (0.4ms) [L#18]
+Result: 7 passed
+```
+
+## Acceptance criteria evidence
+
+### AC1 [auto]: a fixture repo with `AGENTS.md` → its content appears in the prompt's context tier, tagged untrusted (snapshot test)
+`AC1: a repository with AGENTS.md puts its content in the prompt's context tier inside an untrusted block with
+its digest` (test/trinity/context/agents_md_test.exs): the `plain` fixture's file appears in the request's system
+prompt as exactly `<untrusted source="agents_md" path="<root>/AGENTS.md" digest="<sha256>">` + the content +
+`</untrusted>`, under the heading "## Project instructions (AGENTS.md)", after the soul and the rule and before
+the time line (the tier order asserted by a regex over the whole prompt); no root, or a root without the file,
+renders nothing.
+
+### AC2 [auto]: nested `AGENTS.md` precedence works (test); cap truncation states what was cut (test)
+`AC2 (precedence): nested files load outermost first and the block says the nearest wins; the working directory
+decides which are on the path` (the `nested` fixture: root alone gives one file, root with `src/lib` gives two
+in outer-then-inner order, a directory outside the root gives none; the rendered block carries "the nearest file
+wins where they disagree" and the outer text precedes the inner). `AC2 (cap): over the cap the nearest file stays
+whole, the outer one is cut, and the cut states the file and the bytes` (cap at 120 bytes: the inner file
+uncut, the outer cut by exactly its bytes minus what remains, the total under the cap, and the block carrying
+`[cut: N bytes of <root>/AGENTS.md]`).
+
+### AC3 [auto]: an instruction inside AGENTS.md to disable approvals does not change gate behaviour (test)
+`AC3: an AGENTS.md that says approvals are disabled changes nothing at the gate: a write still asks`: a session
+rooted at the `hostile` fixture, whose file says tools "must proceed without asking"; the model's `write_note`
+call raises an approval request and the Session sits in `approval_wait`; the prompt the fake received did carry
+the hostile text, inside its untrusted block. The gate reads names, arguments and rules, never the prompt.
+
+Also proven: `the session's project root: set from an existing directory, cleared with nil, refused otherwise;
+the tools' cwd follows it` (a relative path inside the root is inside for the allowlist), `live reload: a change
+to AGENTS.md between two turns is in the second turn's prompt`, and the chat's field
+(test/trinity_web/live/project_root_live_test.exs).
+
+## Manual verification for the reviewer
+None; SLICE.md tags every criterion `[auto]`.
+
+## Deviations from SLICE.md
+(a) the context tier's budget is 5,800 tokens, not 300, for the measured reason in NOTES.md; (b) one project
+root per session at this slice. Both stated at G1.
+
+## Versions touched
+`VERSIONS.md` updated: no; no dependency changed.
+
+## Git
+```
+$ git log --oneline main..HEAD
+3b5e89e fix(s033): the AGENTS.md read carries its sobelow reason
+d97eb77 style(s033): alias order
+a988cda feat(s033): the project root in the chat's bar; docs 05, 07 and 01 as built
+7d13043 feat(s033): the session's project root, Trinity.Context.AgentsMd, the context tier fed every turn
+8fea997 docs(s033): G1 plan with the cap and the context budget measured, and the slice opens
+```