[HackTuah]

Trinity notices when you have answered the same question the same way enough times, and offers to write the rule so it stops asking. In its own section, read in a calm moment, and never beside a request you are about to decide.

That placement is the whole design

The connectome research report proposed showing a learned recommendation at the arbitration point. Three findings say that is the one place it must not go:

• Anchoring: a recommendation shown before a person forms their own view moves the decision. Trinity's permission model rests entirely on that decision being independent of what the agent wants.
• Automation bias: suggestions get accepted without scrutiny, and monitoring stops.
• Approval fatigue: 49–96% of safety alerts dismissed in the clinical literature; intervention succeeds 9–26% of the time even once a problem surfaces. The cause is volume, so what helps reduces volume rather than annotating it.

So the learned signal is spent on asking less often.

A rule is unanimous or it is not a rule

Nine allows and one refusal proposes nothing — that rule would permit the case you refused. It becomes a divergence to look at instead. Unanimity makes AC3 true by construction rather than by arithmetic.

Two layers hold the placement

• Trinity.Permissions.Learner is not exported from its boundary, so a direct reference does not compile. The compiler enforces it, not a reviewer — and that is what the planted violation ran into first.
• Permissions.proposals/1 is the only way in, and a census covers it. Mutation-tested: a leaked_hint/1 planted in approval_components.ex fails the census by name and goes green when removed.

Not behind a flag. A setting that could put a recommendation back on the approval card would be the same harm with a delay.

Accepting is receipted, and rule writes never were

Store.insert_rule/1 inserted and nothing recorded it. An accepted proposal now writes to a new policy chain scope with the count it rested on — its own scope because a rule outlives the session that prompted it, and the count because without it a reader cannot tell a rule you typed from one you accepted.

Carried with this slice

• CVE-2026-92106 in lazy_html, published today: SVG/MathML script text serialised unescaped. Transitive test dependency, fixed by taking 0.1.13. Slice 120's licence check then caught the stale published list.
• A correction to slice 120. I read a dangling-path report as two missing files and rewrote references to say so. Both exist under process/; the paths were wrong and the check's regex was reporting a fragment out of the middle of a longer path. It is anchored now, and the references point where the files are.

mix gate
Result: 816 passed (14 properties, 802 tests), 18 excluded

Screenshot in the slice record: fs_read at 14 decisions and session_search at 8 offered as rules; fs_write at 9 allowed / 1 denied reported as a disagreement and deliberately not offered.

🤖 Generated with Claude Code