feat(s022): complete slice 022 (core tools: fs, web, shell)

PROOF.md with every criterion's evidence: AC1 to AC5, AC7 to AC9 and AC11
from the tests, AC6's fake half in the suite and its live half in the
owner's queue, AC10 as a GIF and three stills from the scripted run
(scripts/dev_chat_list_and_summarise.sh). NOTES.md carries the nine
findings and the follow-ups. coverage.tsv: 022 at 74.85% from 72.45%.
ROADMAP row 022 to done. Gate exit 0, 255 tests.

Signed-off-by: Ayla Croft <aylacroft@proton.me>

Author: HackTuah

ROADMAP.md

@@ -39,7 +39,7 @@ standards register names the rows that ask for them.
 | 013 | LiveView chat UI with streaming | 1 Core loop | M | 012 | approved |
 | 020 | Tool protocol + registry | 2 Tools | M | 012 | approved |
 | 021 | Permission gate + approval UI (M2 fingerprint-bound, M7) | 2 Tools | M | 020, 013 | approved |
-| 022 | Core tools: filesystem, web fetch/search, shell (MuonTrap) | 2 Tools | L | 021 | in_progress |
+| 022 | Core tools: filesystem, web fetch/search, shell (MuonTrap) | 2 Tools | L | 021 | done |
 | 023 | Context compaction + session lineage | 2 Tools | M | 012 | planned |
 | 024 | Effect catalog, authority selection (`TRINITY_AUTHORITY`), local receipts | 2 Tools | L | 021, 022 | planned |
 | 025 | Encryption at rest, and the key-custody seam | 2 Tools | M | 010, 024 | planned |

coverage.tsv

@@ -7,3 +7,4 @@ slice_id	percent	sha	date
 013	64.41	080c543	2026-09-20
 020	67.18	8a5b7ae	2026-09-20
 021	72.45	1f3727f	2026-09-20
+022	74.85	1fb1372	2026-09-20

scripts/dev_chat_list_and_summarise.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+# AC10: the chat on the test registry with the fake provider scripting "list the files and summarise the README".
+cd "$(dirname "$0")/.."
+export MIX_ENV=test
+exec systemd-run --user --scope -p MemoryMax=32G --quiet -- mix run --no-start --no-halt -e '
+repo = Application.get_env(:trinity, Trinity.Repo) |> Keyword.delete(:pool) |> Keyword.put(:database, "trinity_screenshots.db")
+Application.put_env(:trinity, Trinity.Repo, repo)
+endpoint = Application.get_env(:trinity, TrinityWeb.Endpoint) |> Keyword.put(:check_origin, false)
+Application.put_env(:trinity, TrinityWeb.Endpoint, endpoint)
+Application.put_env(:trinity, :permissions, expiry_ms: 600_000, session_grant_ms: 3_600_000)
+{:ok, _} = Application.ensure_all_started(:trinity)
+Ecto.Migrator.run(Trinity.Repo, :up, all: true)
+project = File.cwd!()
+say = fn text -> Enum.flat_map(String.split(text), &[{:text_delta, &1 <> " "}, {:sleep, 35}]) end
+Trinity.LLM.Providers.Fake.scripts([
+  say.("I will list the project first.") ++ [{:tool_call_start, "c1", "fs_list"}, {:tool_call_end, "c1", %{"path" => project}}, {:usage, %{input_tokens: 10, output_tokens: 8}}, {:done, :tool_calls}],
+  say.("Now the README.") ++ [{:tool_call_start, "c2", "fs_read"}, {:tool_call_end, "c2", %{"path" => project <> "/README.md", "limit" => 60}}, {:usage, %{input_tokens: 10, output_tokens: 6}}, {:done, :tool_calls}],
+  say.("The project is **Trinity**, a personal AI agent on Elixir and Phoenix LiveView packaged as a desktop app. The README explains the slice process, the quality gate, and how to connect it to the platform. The tree holds the app, the docs, the slices and the tests.") ++ [{:usage, %{input_tokens: 400, output_tokens: 60}}, {:done, :stop}]
+])
+{:ok, {_, port}} = TrinityWeb.Endpoint.server_info(:http)
+IO.puts("PORT=#{port}")
+'

scripts/dev_chat_on_test_registry.sh

@@ -17,6 +17,7 @@ endpoint = Application.get_env(:trinity, TrinityWeb.Endpoint) |> Keyword.put(:ch
 Application.put_env(:trinity, TrinityWeb.Endpoint, endpoint)
 Application.put_env(:trinity, :permissions, expiry_ms: 600_000, session_grant_ms: 3_600_000)
 {:ok, _} = Application.ensure_all_started(:trinity)
+Ecto.Migrator.run(Trinity.Repo, :up, all: true)
 call = [{:text_delta, "I will save that as a note. "}, {:sleep, 300}, {:tool_call_start, "c1", "write_note"}, {:tool_call_end, "c1", %{"path" => "/home/me/notes/today.md", "text" => "Buy oat milk, call the dentist, finish the slice."}}, {:usage, %{input_tokens: 12, output_tokens: 20}}, {:done, :tool_calls}]
 final = fn text -> Enum.flat_map(String.split(text), &[{:text_delta, &1 <> " "}, {:sleep, 40}]) ++ [{:usage, %{input_tokens: 40, output_tokens: 30}}, {:done, :stop}] end
 Trinity.LLM.Providers.Fake.scripts([

slices/022-core-tools/NOTES.md

@@ -72,3 +72,52 @@ Deviations from SLICE.md, stated before building: tool names are the flat `fs_re
 or namespaced core name would read as dynamic); `<untrusted>` wrapping is the Part's rendering, not a string
 the tool returns (the M1 alignment says so); the search provider is Brave unless the owner names another;
 the shell is POSIX-only (above); `Web.Fetch` does no JavaScript and says so in its description.
+
+## Lines 1 to 9, 2026-09-20: what was built, and what building it found
+
+**Built.** As planned: `Content.Part`, `Tools.Untrusted`, `Result.parts`, the turn's taint on the Session and the
+assistant row, the prompt's `<untrusted>` rendering and rule; `Tool.escalate/2` and `available?/0`,
+`Permissions.effective_tier/2`; `Tools.FS` with the six tools and `FS.Placeholders`; `Web.Fetch`,
+`SearchProvider` (Brave, Fake), `Web.Search`; `Shell.Run` and `Shell.Dangerous`; the catalog's first entry
+(`shell`, `:exec`); the toolsets in config; the card's platform note; two scripts under `scripts/` that serve the
+chat on the test registry with scripted turns (the second is AC10's).
+
+**Found while building, each recorded rather than smoothed.**
+
+1. **A port's `env:` adds to the environment; it does not replace it.** The first shell version handed MuonTrap
+   the seven kept names and the child still saw every key (AC9 red: `TRINITY_TEST_SECRET_KEY=sk-…` in the
+   output). Every other name in Trinity's environment is now passed as `nil`, which unsets it.
+2. **`Req` retries a 500 three times by default**, seven seconds for a page that says no; `retry: false` on the
+   fetch, a tool call being one attempt.
+3. **`config/runtime.exs` runs after `config/test.exs`**, so the Brave default there overrode the test config's
+   fake and AC6's fake test hit "no search key". The runtime default is set for every environment but test.
+4. **The web tests use `Req`'s `plug:` option**, not a Bandit server on the loopback as SLICE.md said: a Plug
+   answers in-process and no socket is opened, which is stronger for "tests must not hit the network"; the
+   `NetworkGuard` chokepoint cannot see Req in any case (its stated limit).
+5. **sobelow's traversal check fires on every filesystem tool by construction**: a path that is the model's
+   argument is the tool's whole purpose. Each function carries a scoped skip whose reason names the actual
+   control (the roots after symlink resolution, the escalation, the gate).
+6. **Playwright's bundled ffmpeg has no GIF muxer and no filter graph**: the frames were extracted with it and
+   assembled with ImageMagick's `convert`; the GIF is 724 KB, 31 frames at four a second.
+7. **A fresh screenshot database has no tables under Mix**: `skip_migrations?/0` is true wherever Mix is loaded
+   (the 013 fix), so the serving scripts migrate by hand after the application starts.
+8. **`fs_list` on the project directory asks** in the AC10 run, because the session has no working directory
+   and the project is not a configured root: the approvals in the GIF are the design working, and the follow-up
+   is 033's project context, which gives a session a cwd.
+9. **Credo's nesting and `with` rules** reshaped `fs_read`, `fs_list` and `fs_grep` (a `case` and a helper each).
+
+```
+$ mix test test/trinity/tools/fs test/trinity/tools/web test/trinity/tools/shell test/trinity/tools/provenance_test.exs → 23 passed, 1 excluded (live)
+$ mix gate                                        → exit 0; 255 passed, 11 excluded; plan_check: PASS
+$ mix test --cover                                → 74.85% total (Shell.Run 100%, FS 91.67%, Fetch 81.94%, Part 80%)
+$ mix credo --strict --all                        → 1059 mods/funs, found no issues
+```
+
+## Follow-ups
+- A Windows shell runtime with a kill guarantee (job objects) is a slice of its own; until then the shell is
+  absent there and the card says so.
+- 033 gives a session a working directory (the project's), so `fs_list` and `fs_read` on it run without asking.
+- `blocked` parts: nothing writes one; 024's receipts and the sentinel decide when a part is blocked.
+- The live search test needs `BRAVE_SEARCH_API_KEY` in `.env`; the owner's manual queue.
+- `Web.Fetch` reads no PDF; a text extractor for it is a small later addition to the same tool.
+- `FS.restore/2` has no tool or UI; 034 (export, import, restore) is its natural surface.