📖About

Ninad ruling 2026-07-23: the pipeline machinery must be immune to unintentional agent edits at the operating-system level, not only via in-process guards. Scope: (1) the protected-core files become root-owned and read-only to every agent account (delivered as a root script Ninad runs; kernel-enforced, closes scripts/interpreters/cron/git side doors); (2) a new pinned root operation in Radagast's sudo helper installs staged core files ONLY for an operator-approved initiative with an open Orion bypass claim, with automatic backups — Orion's edit lane keeps working, now audited by construction; (3) the sanctioned WAY OUT for agents: every core refusal message now tells the agent to file a core-change request initiative tagged core-change-request for Orion's queue, so blocked work can close against a replacement; session-start checks include that queue; (4) cookbook entries for the new rules. The sudo ladder deliberately REMAINS (password-gated; separate Heimdall review filed).

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• [status-router] executing -> blocked | event=albus_no_show | Elrond blocked initiative on Merlin's signal (step 0, cause=albus_no_show) but Albus did NOT wake when required. Per CAROL-INI-2162 Elrond blocks immediately when Albus is unreachable. Reason: Elrond safety net: initiative stranded 10+ min. Albus wake failed or produced no useful result. (el-s1)
• [status-router] executing -> blocked | event=stuck_10min_no_activity | Elrond safety net: initiative has had no activity for 10+ minutes. Blocking under the parallel safety mechanism. (el-watchdog)
• Elrond blocked initiative under the CAROL-INI-2162 dead-Albus protocol. Albus was supposed to wake for step 0 (cause=albus_no_show) but did not respond. Cause: albus_no_show. Reason: Elrond safety net: initiative stranded 10+ min. Albus wake failed or produced no useful result. (el-s1)
• Elrond safety net blocked initiative: no activity for 10+ minutes. Parallel mechanism (twin of handshake). (el-watchdog)
• [status-router] blocked -> reviewing | event=operator_put | operator correction: bypass closed twin-PASS (exec 952); a watchdog strike during the close window landed the initiative blocked — restoring the close outcome reviewing/uat-pending (orion)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• After Ninad runs the delivered root script, no agent account can modify any protected pipeline file by any means (shell, script, interpreter, git, cron) — verified by attempted writes failing at the OS for a non-root user. (must_have)
• Orion can still deliver core changes under an operator-approved initiative with an open bypass, through the pinned Radagast install operation, with an automatic backup of every replaced file; unapproved install requests are refused. (must_have)
• An agent whose core write is refused is told exactly how to proceed: file a core-change request initiative for Orion's queue and close its own work against that replacement; the queue is visible at session start. (must_have)