📖About

Ninad asked Scriber for the link to his own app and Scriber could not give it. That is not a Scriber problem — it is three gaps in how Carolverse records and shares its own apps.

WHAT IS ACTUALLY WRONG (measured, not assumed):

1. HALF THE ESTATE HAS NO USABLE LINK. Of 82 registered apps, only 41 carry a full address. 39 hold a bare path like '/dev/scriber-logbook/' and 2 hold nothing at all. Scriber's own Logbook is one of the 39, while his other two apps have full addresses — so the record is inconsistent app by app, and no agent can hand a person something they can click. There is no single accessor that returns a usable link.

2. AN AGENT ONLY KNOWS THE APPS IT OWNS. Chat grounding scopes an agent to the apps it owns plus those of everyone below it in the reporting line. There is no notion of "an app I may reach but do not own", so even a correct answer is impossible for anything else. The directory every agent already carries IS the registry — which holds the apps table — but the directory is described to agents as identity and reporting only, so they never look there for an app.

3. THERE IS NO ACCESS SCOPE FOR AGENTS AT ALL. The apps table has an access_level, but that is the HUMAN login tier (public/auth/admin) and must not be overloaded. Nothing records that an app is common to all of Carolverse, or critical to one service.

NINAD'S RULING (2026-07-30): Any agent must be able to give the link to any app it has access to. Constitution, Policies, the Source of Truth and Design are GLOBAL — every Carolverse agent may reach them. A service's critical apps are reachable by every agent in that service. For Build Initiatives those are Initiatives, the Build Cookbook, Initiative Audit and Palantir. The same pattern applies to every other service, not just this one. These rules go into the access policies.

SCOPE: a. ONE canonical absolute link for every app, derived rather than typed, plus a backfill so the record itself is truthful, and a check that no app can lose its link again. b. An agent access SCOPE on each app — global, service or owner — kept separate from the human login tier, with the two named sets seeded and every other service able to declare its own critical apps. c. Agents can name and link any app in their scope: the directory they already carry gains the apps table and the access rule. d. The rules written into the access policies as real numbered policy rows.

DELIBERATELY NOT IN SCOPE: the human login gate is untouched. 'Global' means every AGENT may reach it; a human still signs in exactly as before, and the Source of Truth stays admin-gated for people.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• Ninad can ask any agent for the link to an app it can reach and get a complete, clickable address back - including Scriber and his own Logbook. (must_have)
• Every registered app has one complete address on record; none is left as a bare path or blank, and a check fails if one ever is again. (must_have)
• Every Carolverse agent can reach the Constitution, the Policies, the Source of Truth and Design. (must_have)
• Every agent working in a service can reach that service's critical apps - for Build Initiatives, Initiatives, the Build Cookbook, Initiative Audit and Palantir - and any other service can declare its own without new code. (must_have)
• The access rules are written down as real policies, so the next agent follows them without being told. (must_have)