Slice 013 approved

ROADMAP.md

@@ -36,7 +36,7 @@ standards register names the rows that ask for them.
 | 010 | Core domain + persistence (Ecto/SQLite, schemas, Repo owner) | 1 Core loop | M | 000 | approved |
 | 011 | LLM provider layer (req_llm behind `Trinity.LLM` behaviour) | 1 Core loop | M | 010 | approved |
 | 012 | Session process + agent loop (gen_statem, DynamicSupervisor, rehydration) | 1 Core loop | L | 010, 011 | approved |
-| 013 | LiveView chat UI with streaming | 1 Core loop | M | 012 | done |
+| 013 | LiveView chat UI with streaming | 1 Core loop | M | 012 | approved |
 | 020 | Tool protocol + registry | 2 Tools | M | 012 | planned |
 | 021 | Permission gate + approval UI (M2 fingerprint-bound, M7) | 2 Tools | M | 020, 013 | planned |
 | 022 | Core tools: filesystem, web fetch/search, shell (MuonTrap) | 2 Tools | L | 021 | planned |

docs/03-conventions.md

@@ -57,6 +57,11 @@
 - Merge: a pull request, merge-commit method only, `gate` green on the branch head (repository ruleset, no
   bypass). Tag: `slice/NNN` (annotated), pushed after the merge; tags are protected against update and
   deletion. Never rebase or force-push `main`; the ruleset refuses it anyway.
+- **The merge commit is signed off too.** GitHub writes it, so the sign-off goes in the body given to
+  `gh pr merge --merge --subject "Merge slice/NNN-…" --body "…Signed-off-by: Name <email>"`. Merging with a
+  subject alone produced an unsigned commit under a protected tag once (slice 013, `3db7a5f`), which
+  `scripts/plan_check.sh` rule 8 now names as its one exemption. Check `git log -1 --format=%B` on `main`
+  before tagging; a tag cannot be moved.
 - `mix.lock` is committed. Dependency changes are their own commit: `chore(sNNN): add req_llm ~> 1.10`.
 
 ## Definition of Done

scripts/plan_check.sh

@@ -126,13 +126,22 @@ fi
 
 section "8. Commit messages: no attribution trailers, every commit signed off"
 # Checks the history, not the hook. A bypassed or unconfigured hook still fails here.
+#
+# One named exception, and the reason it exists. The merge commit of slice 013 (pull request
+# #24) was made through `gh pr merge --merge --subject ...` with no `--body`, so GitHub wrote
+# the message and nobody signed it. It is on main under the protected tag slice/013 and cannot
+# be rewritten (CLAUDE.md section 4), so it is listed here by full sha, and only it. The rule
+# that prevents a second one is in docs/03: a merge commit's body carries the sign-off, given
+# to `gh pr merge --body`. Adding a sha to this list is a change to this file, in the open.
+unsigned_merge_exempt="3db7a5ff45773663e1ad31eb02e41655ce36e7b0"
 for c in $(git log --format=%H); do
   body=$(git log -1 --format=%B "$c")
   bad=$(printf '%s\n' "$body" | grep -nE '^(Co-Authored-By: Claude|Claude-Session:|🤖 Generated with)' || true)
   if [ -n "$bad" ]; then
     printf '%s\n' "$bad" | while read -r l; do echo "FAIL commit $c: attribution trailer: $l"; done
     fail=1
   fi
+  case " $unsigned_merge_exempt " in *" $c "*) continue ;; esac
   printf '%s\n' "$body" | grep -q '^Signed-off-by: ' \
     || report "FAIL commit $c: no Signed-off-by line ($(git log -1 --format=%s "$c"))"
 done

slices/013-liveview-chat-streaming/NOTES.md

@@ -255,3 +255,12 @@ workflow's smoke step reading it on every target; `TrinityWeb.Markdown` logging
     liveness read through `kill -0` and `tasklist` (`fix(s010)`, the commit before this record). Run **35523664194**: green
     on all three operating systems, `TRINITY_SMOKE_MARKDOWN=ok` on each, HTTP 200 in 1,526 ms (linux),
     1,680 ms (macOS) and 1,761 ms (windows) from launch. The first green `package` run since the slice/011 tag.
+
+## After approval, 2026-09-20
+
+17. **The merge commit of this slice is unsigned, and it is under a protected tag.** `gh pr merge --merge
+    --subject ...` with no `--body` let GitHub write the message; the slice/012 merge had carried the
+    sign-off in its `--body`. plan_check rule 8 reads the whole history, so every gate failed from that commit
+    on, and `main` cannot be rewritten. Resolution, in the open: rule 8 names `3db7a5ff…` as its one exemption
+    with this reason, docs/03 gains the rule that a merge commit's body carries the sign-off, and the next
+    merge is checked with `git log -1 --format=%B` before the tag. The mistake is mine and the record stays.