📖About

Define and operationalize Carol's user ONBOARDING process, and make user IDENTITY channel-agnostic. Today identity is channel-split (one users row per person-per-channel, loosely linked; folders per-channel; cross-channel memory mirroring). Reform to an ABSOLUTE person identity that does not distinguish users by channel - instead it records which channels each person is active on (a person->channels child record), with ONE person-keyed folder holding subscriptions, agent mappings and memory shared across channels. Migrate existing users into this model with no data loss (backup + dry-run + verify). Document the onboarding process (channels, approval, subscriptions+mapping, status+activity) in a dedicated Policies section and a Carolopedia page. Confirm the user-management process is enabled (stays Carol-owned; documented). Full reform (Ninad ruling). Orion bypass.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• Current state at filing (Elrond validity check): User identity remains channel-split with per-channel user rows, folders, and memory mirroring. Carolopedia and User Management are registered, but no channel-agnostic absolute person model or cross-channel onboarding process has been implemented. Existing users still have fragmented identity per channel. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• [status-router] executing -> parked | event=stuck_10min_no_activity|pipeline_stopped_park_3044 | pipeline stopped (operator OFF or budget-paused) - parked instead of blocked so the stop does not strand live work (CAROL-INI-3044); resumes on turn-ON (el-watchdog)
• Elrond safety net blocked initiative: no activity for 10+ minutes. Parallel mechanism (twin of handshake). (el-watchdog)
• [status-router] parked -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• Channel-agnostic identity: exactly one absolute person identity exists per human, with a child record listing which channels (whatsapp/web/...) that person is active on; the same human on web and WhatsApp resolves to ONE person, not multiple rows. (must_have)
• Existing users are migrated into the canonical person model with NO data loss - subscriptions, agent mappings and memory are preserved and verified against a pre-migration backup. (must_have)
• Onboarding does not branch identity by channel: a new user on ANY channel resolves-or-creates the one absolute person and records that channel as active; the person's folder, subscriptions, mapping and memory are shared across their channels (cross-channel mirroring retired). (must_have)
• The Policies app has a dedicated User Onboarding section documenting the process across the four dimensions: channels, approval, subscriptions+mapping, and status+activity. (must_have)
• Carolopedia has a User Onboarding page describing the end-to-end onboarding process. (must_have)
• The user-management process is confirmed enabled and running (Carol-owned: User Manager, Beacon, Identity Sync, Profiler) and documented in the onboarding process. (must_have)
• Live Carol WhatsApp and web sign-in continue to work across the change with no regression, verified end-to-end. (must_have)