📖About

Carolopedia is public. Fence it: money figures and wish contents are confidential BY CLASS and are redacted wherever Carolopedia renders them - generated prose, guide pages, activity feeds and change feeds alike. The money apps keep their pages with every figure redacted. The fence sits at the RENDERER, not in the stored text, so a newly generated page or a new activity line cannot reintroduce the leak.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• [status-router] executing -> reviewing | event=dispatcher_transition | dispatcher state change (ds-s1)
• [delivery-check] 6 must-have criteria remain pending at bypass_end — delivery FAILED live re-performance; UAT must grade on live evidence, not checklist silence (CAROL-INI-3020): test test_ini3597.py: FAIL (no tests ran in 78.34s (0:01:18)); process check unavailable: BrokenPipeError(32, 'Broken pipe') (orion)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• No Carolopedia page renders a money figure, a daily budget, a cap or a subscription cost (must_have)
• No Carolopedia page renders the content of an agent's wish or the detail of the wish process (must_have)
• The redaction is applied at the renderer, so regenerating a page or adding an activity line cannot reintroduce a leak (must_have)
• A repeatable check fetches every live Carolopedia page and FAILS on any money or wish match (must_have)
• The page WRITER refuses to produce a money figure or wish content, recording a failed run, so the renderer's redaction is a second line of defence and not the only one (must_have)