📖About

The 2026-07-14 20:06 build edit to Carol agt_008 server.py (CAROL-INI-2687 window) removed ~24 unrelated routes (bio, diary, gallery, routine, admin users, robots/sitemap, message-send) and the HTMLResponse import — 243 lines lost. Because nothing restarts or import-tests the service after a build, the damage sat latent until the 2026-07-15 operator restart crash-looped Carol (NameError). Same collateral-damage class was already seen on CAROL-INI-2623-01 (CLI-043 reverted it by hand). Operator restored from the Jul-14 laptop snapshot + re-grafted the legitimate new endpoints (droid-health pa-c3, loopback relay). Fix the class: builds must not rewrite whole files outside scope (surgical-edit contract), and every build touching a service file must prove the service still IMPORTS and boots (py-compile + module-import gate or supervised bounce) before close.

⚖️Decisions

• Current state at filing (Elrond validity check): Carol server still restarts without automated import/boot verification after builds, and builds can still rewrite files beyond scope as seen in the recent CAROL-INI-2687 incident. The operator had to manually restore from a snapshot. No surgical-edit gate or boot/import gate is in place. (elrond)
• Filing mode changed planner -> bypass — Ninad: execute via bypass (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• Caller audit waived by Orion: 2825 touched shared/build_boot_check.py (new), shared/app_compliance.py (facet wiring), shared/test_ini2825.py; shared/bypass.py untouched. (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• Ninad can restart any Carol service right after a build closes and it comes back healthy — verified by a boot/import gate that blocks the build review when the touched service would crash-loop (must_have)
• A build that removes routes or shrinks a served file by a large fraction outside its stated scope is flagged to the reviewer before close, visible on the initiative (must_have)