📖About

NINAD, 2026-08-04 (CLI-228), giving the estate its allocation PRESCRIPTION in five rules: 1. one subscription per track, strictly. 2. keep allocations simple - less engineering, less variety of models. 3. Claude Opus/Fable for the Orion bypass (budget-exempt). 4. critical workloads (Albus bypass) and user-facing services (consciousness, chat, blogs) on Codex; ALL OTHERS on DeepSeek. Kimi stays as a backup to DeepSeek. 5. image, video and speech on Gemini. Then: "ensure that the workloads reflect this prescription, and carol intelligence reflects the workloads (+ prescription where workload history is genuinely not present)". Ruling this session, on being shown the conflict below: "author (orion's droid) and albus go on codex".

WHERE THE ESTATE ALREADY STANDS, measured not asserted (2026-08-04 11:0x): The track -> resolver wiring went live TODAY (CAROL-INI-3673/3678), so a track's declared lane now actually drives the call that gets made. Consequence: 35 of 36 track declarations ALREADY match the prescription, and every one of 403 active droids resolves to its own track's lane. This initiative is therefore small and surgical - the structural work was done hours ago by a parallel lane.

SCOPE - three things.

1. THE ONE TRACK THAT CONTRADICTS RULE 4. The Albus Bypass track declares Claude Fable and its runner resolves to it. Rule 4 puts critical workloads on Codex. Moving it makes "Claude Max is reserved for Orion alone" (cookbook 589/590) true BY CONSTRUCTION rather than by a standing exception.

2. THE AUTHOR'S CLAUDE EXCEPTION IS ALREADY DEAD, AND SILENTLY. Cookbook 1153 says the Author writes Orion's Logbook on the Claude subscription - the ONE exception to Claude-is-CLI-only. MEASURED: the Author now resolves to Codex, because its track carries the lane and OUTRANKS the per-droid pin that used to carry the exception. So the rule has been false since the track wiring shipped, and nothing said so. Ninad's ruling this session makes Codex correct; the rule must be RETIRED, not left to rot. A cookbook rule that contradicts the running system is worse than no rule - it is a rule a future session will obey.

3. CAROL INTELLIGENCE MUST NAME WHAT WILL RUN. Where a track has recorded nothing, the page says "nothing recorded" and stops - so the reader learns neither what ran nor what WILL run. It must name the model the track WILL trigger, which is the declared lane, kept visibly distinct from observed evidence (never merged - CAROL-INI-3666's whole point, and Ninad's own ruling that a declaration is made by hand and never inferred from calls).

AND THE INSTRUMENT CRIES WOLF, which inflates exactly this case. The observed window is DAY-granular while a re-tag is TIMESTAMPED. 14 tracks were re-tagged at 10:41:37 today, so calls made this morning under the PREVIOUS declaration are counted against the NEW one: 8 tracks are flagged as running something they do not declare when every one of them is compliant. Same defect inflates the empty set - 21 of 36 tracks read as "nothing recorded" largely BECAUSE the re-tag reset their evidence to today. Suspect the instrument first: fix the window to compare at the same resolution the re-tag is recorded at.

OUT OF SCOPE, each surfaced this session and filed separately rather than smuggled in here: - Carol's own speech billing a DeepSeek track (needs its own Gemini track) - rule 1 and rule 5. - Kimi declared as DeepSeek's backup but wired as a manual switch, with ~40 dead fallbacks pointing at an OpenAI account with no credit since 15 July. - Two DeepSeek models in play (Pro on escalated planner, Flash elsewhere) vs rule 2. - The 70 now-inert per-droid pins in the protected config, ~20 of which say the opposite of their track. - shared/llm_provider.py itself: a PARALLEL ORION LANE has CAROL-INI-3678 in review on that exact file. Not touched here. Its runs are left alone (feedback_parallel_orion_lanes).

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• Current state at filing (Elrond validity check): The track-to-resolver wiring went live today, so 35 of 36 track declarations already match Ninad's prescription and all 403 active droids resolve to their own track's lane. The Albus Bypass track still declares Claude Fable instead of Codex, the Author's cookbook Claude exception is still live, and Carol Intelligence does not yet name a will-run model purely from declarations where ledger history is absent. The observed-vs-declared comparison window also still needs to align with the resolution at which re-tags are recorded. (elrond)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• Carol text-to-speech runs Gemini while billing the sales track, which declares DeepSeek: the only calls in the estate running a subscription their track does not declare. Breaks rule 1 and rule 5. Filing it was REFUSED by the duplicate gate as the same underlying work as open #3678 (the parallel lane resolver-wiring arc). The gate is not fought: recorded here so the objective cannot be buried by plumbing (cookbook 713), and reported to Ninad. Cure is a Gemini track for Carol speech reached through its TASK - never a per-droid pin. — Carol text-to-speech runs Gemini while billing the sales track, which declares DeepSeek: the only calls in the estate running a subscription their track does not declare. Breaks rule 1 and rule 5. Filing it was REFUSED by the duplicate gate as the same underlying work as open #3678 (the parallel lane resolver-wiring arc). The gate is not fought: recorded here so the objective cannot be buried by plumbing (cookbook 713), and reported to Ninad. Cure is a Gemini track for Carol speech reached through its TASK - never a per-droid pin.
• Rule 4 ends "Kimi stays as a backup to DeepSeek". Measured: Kimi is a manual fleet switch, supports 0 services, and NOTHING fails over to it. Meanwhile ~40 per-droid fallbacks still name the metered OpenAI account recorded as having no credit since 15 July - so the wired backup is dead and the declared one is not wired. Question for Ninad: does backup mean automatic failover on a DeepSeek error, or a standby lane he switches to deliberately? Filing refused as duplicate of this initiative; recorded here. — Rule 4 ends "Kimi stays as a backup to DeepSeek". Measured: Kimi is a manual fleet switch, supports 0 services, and NOTHING fails over to it. Meanwhile ~40 per-droid fallbacks still name the metered OpenAI account recorded as having no credit since 15 July - so the wired backup is dead and the declared one is not wired. Question for Ninad: does backup mean automatic failover on a DeepSeek error, or a standby lane he switches to deliberately? Filing refused as duplicate of this initiative; recorded here.
• DeepSeek runs v4-flash everywhere except the escalated planner track, which declares v4-pro; the main planner track was observed running both (2465 pro vs 1667 flash over 7 days). Gemini carries an image model and a TTS model, which is two capabilities rather than variety. Rule 2 asks for less variety: the DeepSeek pro-vs-flash split is the real question and it is NINAD-S CALL, not mine. — DeepSeek runs v4-flash everywhere except the escalated planner track, which declares v4-pro; the main planner track was observed running both (2465 pro vs 1667 flash over 7 days). Gemini carries an image model and a TTS model, which is two capabilities rather than variety. Rule 2 asks for less variety: the DeepSeek pro-vs-flash split is the real question and it is NINAD-S CALL, not mine.
• The task-to-track lane outranks the per-droid pin, so all 70 pins in the protected LLM config change nothing today - but about 20 of them declare the OPPOSITE of the track they sit on, in a root-owned file, and read as authority to anyone who opens it. Removing them is a core install. Left alone deliberately: CAROL-INI-3678 names them out of scope too, and adding a second cleanup lane over the same file is how two sessions clobber each other. — The task-to-track lane outranks the per-droid pin, so all 70 pins in the protected LLM config change nothing today - but about 20 of them declare the OPPOSITE of the track they sit on, in a root-owned file, and read as authority to anyone who opens it. Removing them is a core install. Left alone deliberately: CAROL-INI-3678 names them out of scope too, and adding a second cleanup lane over the same file is how two sessions clobber each other.
• test_carol_intelligence.py has 3 failures asserting the pre-tracks shape - they read svc["blocks"] and a fixed four-box list with no codex or gemini box. Proven pre-existing by reverting this initiative changes and re-running: identical 3 failures. They belong to this mornings tracks-only arc, not here. Reported rather than silently fixed or silently ignored. — test_carol_intelligence.py has 3 failures asserting the pre-tracks shape - they read svc["blocks"] and a fixed four-box list with no codex or gemini box. Proven pre-existing by reverting this initiative changes and re-running: identical 3 failures. They belong to this mornings tracks-only arc, not here. Reported rather than silently fixed or silently ignored.
• [delivery-check] 8 must-have criteria remain pending at bypass_end — delivery has no mechanical re-performance lane; UAT must grade on live evidence, not checklist silence (CAROL-INI-3020): (no detail) (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> blocked | event=reviewer_verdict | bypass twin reviewer verdict != pass (CAROL-INI-2039) (orion)
• [status-router] blocked -> reviewing | event=reviewer_verdict | Twin reviewer or-rv-01 re-graded the standing attempt PASS (5 checks, 0 failing) after the checks it needed were recorded. The earlier FAIL was correct at the time and is not being papered over: it said the attempt had recorded no checks, which is unauditable rather than clean, and that was true. The work itself was already done and verified by running. Parking in reviewing for UAT, which is where a closed bypass belongs. (orion)
• [status-router] reviewing -> executing | event=operator_put | OPERATOR PUT, not a UAT sign-off - Ninad has not signed off and I will not sign for him. He added scope on the SAME arc while this sat in UAT (CLI-228): remove every automated fallback so a dry subscription FAILS the job, and clean the 70 inert per-droid pins. Seven new must-have criteria were added BEFORE this move so the reviewer grades the whole objective. A separate filing was attempted first and refused three times by the duplicate gate, naming three different initiatives (3678, 3680, 3672) - it over-matches on the word fallback. The run-1 scope is delivered and unchanged. (orion)
• [delivery-check] 15 must-have criteria remain pending at bypass_end — delivery has no mechanical re-performance lane; UAT must grade on live evidence, not checklist silence (CAROL-INI-3020): (no detail) (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• The Albus Bypass track declares Codex, and Albus's bypass runner is PROVEN by a real resolution call to resolve to Codex - not by reading the record back. (must_have)
• No track in the estate declares Claude except the Orion bypass (CLI) track, so rule 4 holds by construction. (must_have)
• The Author resolves to Codex and cookbook 1153's Claude exception is RETIRED with its reason recorded, so no future session obeys a rule the system already contradicts. (must_have)
• Carol Intelligence names the model a track WILL trigger when the ledger has recorded nothing for it, shown as the declaration and never merged with observed evidence. (must_have)
• The observed-vs-declared window compares at the same resolution a re-tag is recorded at, so a same-day re-tag can no longer report the previous arrangement's calls against the new declaration. (must_have)
• The 8 tracks currently flagged as running something they do not declare are re-measured; each is either shown compliant or named as a real breach with its evidence. (must_have)
• Every track's declared lane is verified against Ninad's five rules one by one, and any track that cannot be made to comply is REPORTED rather than quietly exempted. (must_have)
• shared/llm_provider.py is not modified by this initiative - the parallel lane's CAROL-INI-3678 owns that file. (must_have)
• All 70 per-droid pins are gone from the protected LLM config, and every affected droid is PROVEN by a real resolution call to resolve exactly as before - they were inert, so removal must change nothing. (must_have)
• No fallback declaration remains anywhere; in particular nothing names the OpenAI account with no credit since 15 July. (must_have)
• Both automated fallback paths - the declared-fallback hop and the fail-open fleet net - are removed from the call layer, so a provider error returns to the caller and the job FAILS (Ninad 2026-08-04: money running dry must stop work, not move it to another subscription). (must_have)
• (must_have)
• The cross-cutting lanes (chat, consciousness, Orion), the Claude ringfence and Carol lane block still work afterwards, each proven by a resolution call. (must_have)
• Both DeepSeek models retained with the tier reason recorded (Ninad left it to my call), and their identical rates reported rather than quietly changed. (must_have)
• Installed through Radagast core lane with replaced files backed up - never a raw sudo. (must_have)