From 36582865029f2405a4a1f00dcb597506c9a3546b Mon Sep 17 00:00:00 2001 From: Ayla Croft Date: Thu, 24 Sep 2026 10:14:16 -0400 Subject: [PATCH] docs(s027): the changelog entry and the coverage row for slice 027 Written before the tag rather than after it, which is the direction test/changelog_test.exs allows: every tag needs an entry, an entry without a tag is fine. Slice 090 built that test after finding two tags with no entry at all, and this is the first slice to close under it. It should have been in the slice's own pull request. It was not, and the test caught the gap the moment the tag was considered, which is the test working. Signed-off-by: Ayla Croft --- CHANGELOG.md | 27 +++++++++++++++++++++++++++ coverage.tsv | 1 + 2 files changed, 28 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 857b44d..cb0230d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -24,6 +24,33 @@ evidence for each increment is retained by the maintainers and summarised here. ## 2026-09-24 +### `slice/027` — The authority census, stated and published +The set of things that can cause an effect is now one generated file, +[`docs/effects-catalog.md`](docs/effects-catalog.md), with a row per core tool giving its risk tier, +its effect class, whether its name is in the closed external-effect catalogue and whether it can +raise its own requirement. The version is a SHA-256 over the rows, so two trees with the same effect +surface carry the same version and nobody types a number. The check runs in the release check the +gate already runs, and it is proven to fail rather than assumed to: changing one cell of the +committed artifact turns the build red. + +Two censuses that already existed became falsifiable. The callers of the effect membrane now carry +the reason each one is allowed, so a third has something to argue against. A new census asserts that +nothing in the permission, effect or authority path reads session state, holding a distinction worth +stating: a session id is a scope key and narrows a grant, while what a session has been saying is +state and would steer a decision. Every message is a place an injected instruction can sit, so a gate +blind to the conversation keeps prompt injection a question about what is proposed rather than about +what is authorised. + +Both censuses plant a real violation that they must find, and the discipline paid for itself here: +the new census's first pattern could not see a fully qualified call, and without the plant it would +have reported the decision path clean while measuring nothing. + +Derived from the *Drosophila* male CNS connectome research of 2026-09-13, which Trinity uses as a +source of architectural arguments rather than of algorithms. What it argues here is that authority to +act should rest with a population small enough to count, that state which tracks what is happening +should not be the thing that commands, and that the inventory should be published rather than +described. + ### `slice/090.1` — Observability and the cost ledger Every LLM call, tool call, approval, session transition, gateway message and budget refusal emits a `:telemetry` event from a single catalogue (`docs/telemetry.md`), written before the emitters rather diff --git a/coverage.tsv b/coverage.tsv index 5abc965..b68400e 100644 --- a/coverage.tsv +++ b/coverage.tsv @@ -26,3 +26,4 @@ slice_id percent sha date 025 80.31 2c4fe1f 2026-09-23 080 80.31 a7630ba 2026-09-24 090 80.31 3e4185a 2026-09-24 +027 80.31 f0b02f5 2026-09-24