📖About

Two faults in the same place, found while moving the lanes off Claude (CLI-171, Ninad's instruction to close the adapter gap).

THE LOCK IS OFF. The protected core is meant to be root-owned and kernel-enforced. 12 of its 89 files are not: the whole LLM adapter layer (all ten provider modules), the provider config, and the switch tool are owned by the ordinary account and writable by it. That is the layer that talks to every paid model. The sanctioned install lane cannot even reach them — its destination pattern allows no subdirectory under shared/ — so the files were declared protected and then left open, with no way to close them.

THE CLAUDE LANE NEVER PRICES ITSELF. Four of the five provider adapters compute a cost from the rate card. A subscription lane still has a cost worth attributing; cookbook 842 already settled that for Kimi.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• The lock on the LLM engine was off, and the install lane could not reach it — 12 of 89 protected-core files were owned by the ordinary account and writable by it — all ten provider adapters, the provider config and the switch tool. The core-install destination pattern allowed no subdirectory under shared/, so the files were declared protected and then left open with no sanctioned way to close them. The ROOT HELPER already accepted the path; only the daemon-side pattern refused it. (orion)
• Widened the lane and locked what it could reach; two files done, ten waiting on a root restart — radagast_sudo.py and tools/llm_switch.py went through the lane and are now root-owned. The adapter installs are refused by the sudo DAEMON, which has been running since 28 July with the old pattern in memory — my process allows them (verified by driving the gate function directly). Radagast cannot restart himself by design, so this needs root. (orion)
• The Claude lane now prices what it estimates, as an attribution proxy — Four of five adapters computed a cost; this one estimated tokens and stopped. Now consults the rate card and marks the figure _cost_is_proxy — a subscription lane has no per-call invoice, exactly the treatment cookbook 842 settled for Kimi. The Model Subscriptions app stays the authority on what is actually paid. (orion)
• TWO FALSE PASSES IN MY OWN VERIFICATION, both caught by driving the real code — First I 'proved' the pricing with a live call as an Orion droid — but that droid has no override, so the call went to the fleet provider and never touched this adapter, while my check read an OLD ledger row and printed PRICED. Second, driving the real function showed cost 0.00: the block resolved no model name, so the rate card returned zero and the 'fix' changed nothing. Now proven deterministically — 10,000 in + 1,000 out prices at 0.075, agreeing with the rate card. A live call that does not reach the code you changed is not evidence. (orion)
• The check is deliberately RED while the gap remains — test_ini3473 fails its first assertion while any protected file is still writable by the ordinary account. A gap recorded only in a handover gets forgotten; one that reds the suite does not. It turns green the moment the remaining files are locked. (orion)
• A shared staging directory is a hazard worth naming — The core-install staging area is shared between sessions and already held a generic claude.py from other work. Staging mine under the same name would have been one mis-typed destination away from installing an adapter over the core module. Everything here is staged under an initiative-scoped name. (orion)
• [delivery-check] 1 must-have criteria remain pending at bypass_end — delivery FAILED live re-performance; UAT must grade on live evidence, not checklist silence (CAROL-INI-3020): test test_ini3473.py: FAIL (no tests ran in 0.68s) (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• The lock is now real, and the check is what says so — Ninad ran the two root commands; the deliberately-red assertion turned green (9/1 -> 10/0). RESIDUAL flagged for a separate ruling: the containing directory stays group-writable, so a root-owned file can still be replaced by renaming around it. That applies to the whole core, not just this layer. (orion)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• Every file the system calls protected core is genuinely locked against the ordinary account, and anything left open is reported loudly rather than assumed safe. (must_have)
• A change to the LLM adapter layer can only be made through the same approved lane as the rest of the core. (must_have)
• Work done on the Claude subscription shows what it was worth, instead of recording zero or a figure that contradicts its own token counts. (must_have)