[HackTuah]

From the male CNS connectome research report of 2026-09-13, implemented where it fits: A2 (a small enumerable population carries all authority to act), A5 (the compass tracks state and does not command) and A8 (a closed, versioned, publicly checkable catalogue).

This slice changes nothing about what the tree permits. Two of its three claims were already true and neither was checked. It makes existing claims falsifiable.

What it adds

docs/effects-catalog.md, generated from the configured core tools and their behaviour callbacks: one row per tool with the risk tier, the effect class, whether the name is in the closed external-effect catalogue, whether it can escalate, and the module. The version is a SHA-256 over its own rows, so two trees with the same effect surface carry the same version.

mix trinity.effects.catalog --check is step 3 of scripts/prod_check.sh, which the gate runs. It is proven to fail, not assumed to: changing one cell of the committed artifact turns the release check red, and restoring it turns it green.

--write and --check refuse outside MIX_ENV=prod. The first generated artifact was built under :test and named test scaffolding beside fs_read, five entries longer than production. A gate running in :test would have compared a test surface against a production one and failed forever, and the obvious fix would have been to commit the test surface as though it were the product.

The effects census carries a reason per allowed caller, not a bare list of two paths, and a test refuses a reason too short to be one.

A new census asserts no module in permissions, effects or authority reads session state. The distinction is the point: a session id is a scope key and narrows a grant; what the session has been saying is state and would steer a decision. Every message is a place an injected instruction can sit, so a gate that reads conversation state is one an attacker can argue with, and the argument need not convince a person, only move one boolean.

Two things the tree caught

The planted reader justified itself immediately: the census's first regex excluded a dot before Sessions and could not see the fully qualified call the plant makes. Without the plant it would have reported the decision path clean while measuring nothing.

Slice 020's census then caught this work. The new task's moduledoc named a test tool as an example, and nothing under lib/ may reference test scaffolding. The census is right and the example was not worth it.

Verification

mix gate
Result: 683 passed, 18 excluded
trinity.coverage: 090 80.31% vs 080 80.31%: OK

🤖 Generated with Claude Code