docs: the changelog covers every tag, and a test keeps it that way

CHANGELOG.md says of itself that it is derived from the tags rather than written
from memory. It was not. slice/002 and slice/025 had no entry: both were merged on
a day when other work merged too, and both were missed. Nothing failed, because
nothing was checking.

A public record of delivered work that is quietly incomplete is worse than one
that admits a gap, because a reader cannot tell which kind they are holding. So
the two entries are written, 080 and 090 are added, and a test now reads
git tag -l 'slice/*' and requires an entry for each.

The test refuses to pass when the checkout has no tags. actions/checkout at its
default depth of one fetches none, and a test that finds nothing to check is
indistinguishable from one that found everything in order; the postgres leg
therefore checks out with fetch-depth 0, as the gate and fips legs already did.

The direction is one-way on purpose. Every tag needs an entry; an entry without a
tag is fine, because a slice's entry is written in the pull request that closes it
and lands before the tag exists.

mix gate: 679 passed, 18 excluded; coverage 80.31%, unchanged.

Signed-off-by: Ayla Croft <aylacroft@proton.me>

Author: HackTuah

.github/workflows/gate.yml

@@ -82,6 +82,11 @@ jobs:
       DATABASE_URL: postgres://trinity:trinity@localhost:5432/trinity_test
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          # `test/changelog_test.exs` reads `git tag -l 'slice/*'` and refuses to pass without
+          # tags, because a test that finds nothing to check is indistinguishable from one that
+          # found everything in order. The default depth of one fetches no tags.
+          fetch-depth: 0
 
       - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         with:

CHANGELOG.md

@@ -22,8 +22,55 @@ evidence for each increment is retained by the maintainers and summarised here.
   tree, engineering rules consolidated into `docs/03-conventions.md`, and this changelog added as
   the public record of delivered work.
 
+## 2026-09-24
+
+### `slice/090.1` — Observability and the cost ledger
+Every LLM call, tool call, approval, session transition, gateway message and budget refusal emits a
+`:telemetry` event from a single catalogue (`docs/telemetry.md`), written before the emitters rather
+than documented after them, under one rule over the whole set: no prompt text, no completion text,
+no tool arguments and no key material. A turn carries a trace identifier into the task that runs it,
+so a turn reads as a tree without a tracing library and without a new dependency. A primary Logger
+filter redacts credentials by shape rather than by name, so a secret nobody thought to list is still
+caught, and it rewrites a message rather than dropping it. The cost ledger reads the usage rows the
+tree already writes, by day, model, session and persona, against budgets that warn and, when
+configured to, refuse. `/activity` shows the live event stream with the spend beside it, and a
+LiveDashboard page lists running sessions by asking each process its state rather than reading a row.
+OpenTelemetry was assessed and deferred against a measured need rather than added because the
+criterion named it; the reason is recorded with the slice.
+
+**Tagged `slice/090.1`, not `slice/090`.** The `slice/090` tag was pushed before its merge had
+landed and points at slice 080's merge commit. This repository's ruleset forbids moving or deleting
+a tag, so the error is permanent and public; the correct tag carries the correction in its own
+annotation rather than leaving a reader to reconcile the two.
+
+### `slice/080` — Subagents and delegation
+The assistant can hand a bounded piece of work to a child session through a `delegate` tool. The
+child has its own context and its own history, and hands back a result as text: the parent's
+conversation never contains the child's messages, which is the property that makes delegation worth
+having. Several children run at once under a concurrency cap, each with a budget in turns, tokens
+and wall clock; exceeding it stops the child and says so. A child that dies does not take its parent
+with it, and the parent is told; cancelling a parent cancels the tree beneath it. Approvals a child
+raises appear on the same permissions page as any other, named with the child that raised them, and
+a `/subagents` panel shows what is running with a stop control for each.
+
 ## 2026-09-23
 
+### `slice/025` — Encryption at rest, and the key-custody seam
+The database, the receipt chain and the key material can be sealed at rest, and the seam that holds
+the keys is named rather than assumed. Sealing is a deployment decision with the trade-off stated in
+both directions: a key lost is data lost, so the custody options are documented with their recovery
+paths, and the default is the one whose failure mode an operator can survive. What the seam does
+*not* cover is written down beside what it does.
+
+### `slice/002` — Supply chain, early
+A CycloneDX bill of materials is generated by the quality gate on every commit and ships beside
+every packaged binary, so whoever holds an artifact holds the list of what is in it; the bill states
+its own coverage inside the document, including what it does not cover. Every packaged binary
+carries build provenance attested through the workflow's own identity and recorded in a public
+transparency log, verified in the same run that produced it. A minimum TLS version is enforced for
+outbound connections. Brought forward from M9 because a supply-chain claim made late is a claim
+made about work already done.
+
 ### `slice/070` — Gateway core
 Trinity becomes reachable from channels other than the desktop. An adapter behaviour carries text
 and nothing else; a router admits the sender, applies a rate limit, dispatches commands and binds

test/changelog_test.exs

@@ -0,0 +1,48 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule ChangelogTest do
+  @moduledoc """
+  `CHANGELOG.md` says of itself that it "is derived from the tags themselves
+  (`git tag -l 'slice/*'`), not written from memory". This test is what makes that sentence true.
+
+  It was not true when the test was written. Two tags, `slice/002` and `slice/025`, had no entry:
+  both were merged on a day when two other things were also merged, and both were simply missed.
+  Nothing failed, because nothing was checking. A public record of delivered work that is quietly
+  incomplete is worse than one that admits a gap, because a reader has no way to tell which kind
+  they are holding.
+
+  **Why the empty case is a failure rather than a skip.** A checkout without tags - `actions/checkout`
+  at its default depth of one - can run this test and find nothing to check, and a test that passes
+  because it had nothing to look at is indistinguishable from one that passed because the tree was
+  right. Every CI leg that runs the suite therefore checks out with `fetch-depth: 0`, and this test
+  refuses to pass without tags rather than quietly agreeing.
+
+  The direction is deliberate: every tag must have an entry, and an entry with no tag is fine. A
+  slice's entry is written in the pull request that closes it, which lands before the tag exists.
+  """
+  use ExUnit.Case, async: true
+
+  @changelog "CHANGELOG.md"
+
+  defp tags do
+    {out, 0} = System.cmd("git", ["tag", "-l", "slice/*"])
+    out |> String.split("\n", trim: true) |> Enum.sort()
+  end
+
+  test "the checkout has the tags this test reads" do
+    assert tags() != [],
+           "`git tag -l 'slice/*'` found nothing, so this test cannot check anything. A CI job " <>
+             "running the suite must check out with `fetch-depth: 0`; a local clone has the tags " <>
+             "already. Passing here without tags would be a pass that measured nothing"
+  end
+
+  test "every slice tag has an entry in the changelog" do
+    text = File.read!(@changelog)
+
+    missing = Enum.reject(tags(), &String.contains?(text, "`#{&1}`"))
+
+    assert missing == [],
+           "#{@changelog} has no entry for #{Enum.join(missing, ", ")}. The file states it is " <>
+             "derived from the tags; add the entry rather than the exception"
+  end
+end