📖About

Phase 1b of the spend-accountability plan (Ninad ruling, CLI-165: start with the droids consuming most of the cost, then continue with the others).

Proof: 137 of its calls span three regression runs and ZERO occur after a run finishes. The suite now declares itself a test, so that spend is already accounted for as test work from the next run - this initiative verifies that live rather than assuming it.

What remains is the long tail: 94 distinct spenders, and teaching each one to declare its job by hand would be slow, would miss the rare ones, and would rot. Instead the registry already records what every droid EXISTS to do - a name and a written purpose per droid. Where no explicit ticket is in force, the ticket is DERIVED from that record: Clara's Carolopedia scanner spending money reads as 'keep Carolopedia current', not as an anonymous charge.

A derived ticket is never allowed to masquerade as a declared one. It is marked as derived, and coverage reports declared and derived separately, because the difference is exactly the signal that matters: a standing sweep doing its standing job is fully explained by the registry, while build work with no initiative behind it is NOT explained by anything and stays visible as the anomaly it is - which is precisely the shape of the leak that started this.

Also wires explicit tickets into the two remaining live lanes that carry real user meaning: Carol's conversation path and the consciousness wake loop. No protected-core file is touched.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• Compliance waived by orion (operator) with evidence — all 8 gaps are foreign to this initiative and each is explained. THIS BYPASS CHANGED EXACTLY SEVEN FILES: shared/work_ticket.py, tools/work_ticket_coverage.py, shared/test_ini3456.py (new); shared/cost_log.py, shared/prompt_context.py, tools/audit_wrapper.py, regression/runner.py, shared/skill_execution.py, shared/planner_simplified.py, regression/tests.json (edited). NONE of the flagged paths is among them. (1) The [core] gap names 6 pipeline-core droids I never opened; protected core was deliberately avoided by this design. (2) Three files reported as 'shrank to 0B' — Elrond's pm_s1, Merlin's sr_01 and the VM-metrics app — DO NOT EXIST: they were retired by earlier initiatives, and the gate reports a deleted file as a shrink to zero. (3) shared/llm_provider.py (-75%) and shared/budget_monitor.py (-46%) are root-owned protected core last modified 26 and 23 Jul, both BEFORE this bypass opened; their shrink is the legitimate refactor that moved provider code into the adapter layer and budgets into their own store. llm_provider was verified healthy at waive time: it imports and exposes 30 functions. (4) Clara's agent module failing to import shared.agentbook is a pre-existing breakage in another agent's tree. ROOT CAUSE UNFIXED AND ALREADY REPORTED TO NINAD: the delivery-compliance baseline is stale, so it cries wolf on every bypass, and its out-of-scope follow-on cannot file because it bounces on the budget gate (CAROL-INI-2803) — so nothing carries the finding. That belongs in its own initiative. (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• The largest single source of metered spend can say what its money went on, verified on a real run rather than assumed. (must_have)
• A droid that has never been taught to declare its job still says what it stands for, taken from what the registry already records about it - so the long tail is covered without editing every caller. (must_have)
• Work that merely stands for something is never counted as work that declared itself; anyone reading the coverage can tell the two apart at a glance. (must_have)
• A conversation with Carol, and an agent waking up to think, each say what that work was for. (must_have)
• Carol keeps working exactly as before if this is broken or switched off, and no model call is ever blocked by it. (must_have)