Version 372070cf9a41c640, which is a SHA-256 over the rows below rather than a number anyone
typed. Two trees with the same effect surface carry the same version. Built from MIX_ENV=prod,
which --write and --check require to be prod, because this is a statement about what ships.
This is the population that can cause an effect, in one place. It is otherwise spread across a
behaviour (Trinity.Tools.Tool), a configuration list, a closed catalogue module
(Trinity.Tools.Catalog) and an authority adapter, and a reader would have to assemble it to
check any claim this project makes about least privilege.
What is not here is the point of it. Tools registered at runtime, from an MCP server or a
skill, never appear: they can propose a call, and the membrane refuses an effectful one that is
not in this list. mix trinity.effects.catalog --check is in the quality gate, so a tool added
without this file changing fails the build.
| Tool | Risk tier | Effect class | In the closed catalogue | Can escalate | Module |
|---|---|---|---|---|---|
delegate |
read |
none |
no | no | Trinity.Tools.Delegate |
fs_edit |
write |
artifact |
no | yes | Trinity.Tools.FS.Edit |
fs_glob |
read |
none |
no | yes | Trinity.Tools.FS.Glob |
fs_grep |
read |
none |
no | yes | Trinity.Tools.FS.Grep |
fs_list |
read |
none |
no | yes | Trinity.Tools.FS.List |
fs_read |
read |
none |
no | yes | Trinity.Tools.FS.Read |
fs_write |
write |
artifact |
no | yes | Trinity.Tools.FS.Write |
learn |
write |
artifact |
no | no | Trinity.Skills.Tools.Learn |
memory |
write |
artifact |
no | no | Trinity.Tools.Memory |
recall |
read |
none |
no | no | Trinity.Tools.Recall |
run_lua |
exec |
none |
no | no | Trinity.Sandbox.Tool |
session_search |
read |
none |
no | no | Trinity.Tools.SessionSearch |
shell |
exec |
catalog |
yes | yes | Trinity.Tools.Shell.Run |
skill_file |
read |
none |
no | no | Trinity.Skills.Tools.File |
skill_manage |
write |
artifact |
no | no | Trinity.Skills.Tools.Manage |
skill_view |
read |
none |
no | no | Trinity.Skills.Tools.View |
skills_list |
read |
none |
no | no | Trinity.Skills.Tools.List |
web_fetch |
network |
none |
no | yes | Trinity.Tools.Web.Fetch |
web_search |
network |
none |
no | no | Trinity.Tools.Web.Search |
- Risk tier is a function of the tool's name alone. Arguments can raise what a call requires (the next column); they can never change the tier.
- Effect class is what the membrane reads.
:nonenever reachesTrinity.Effects;:artifactand:catalogboth cross it and both leave a signed receipt. - In the closed catalogue means the name is in
Trinity.Tools.Catalog, the compile-time list of external effects. The registry refuses a runtime registration claiming:catalog. - Can escalate means the tool implements
escalate/2, which may raise a single call's required tier from its arguments. It is one-way by the behaviour's contract.
Under the default authority (TRINITY_AUTHORITY=local, ADR-0010) Trinity.Authority.Local is
the executor and runs the tool's own execute/2. Under an external authority adapter Trinity
keeps no executor for catalogued effects: it proposes, the adapter decides and acts, and the
census test for that mode asserts the absence rather than describing it. The mode is chosen
once at boot, recorded in the boot receipt, and no runtime path changes it.