📖About

Ninad ruling (CLI-243, 2026-08-12): the agent-chat service is served by coding-agent INSTANCES, not API chat completions - a subscribed external user talking to Leo in the Leo Chat app is talking to a Claude Code instance of Carolverse carrying Leo's identity and grounding. Test with Claude Code first, then extend to Codex and other coding agents. Design-first: the runner needs a sandboxed tool set (external input drives a tool-running agent), per-project-instance session handling, a billing seam so turns land on the Leo Chat track ledger (CLI usage does not pass Carol's ledger today), and the operator exceptions this reverses recorded with dates (chat-on-GPT, Claude reservation, CLI-lane fleet disconnect).

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• Ninad ruling (CLI-243): Carol's and Sam's chats STAY on the current serving; ONLY Leo's chat shifts to Claude Code (Fable). Their tracks and declarations are untouched by this initiative.
• Ninad ruling (CLI-243): budgets and EXEMPTIONS are per TRACK, never per model or subscription. The Orion bypass track is exempt; the Leo Chat track is NOT and must keep enforcing its cap after the Claude Code migration - the runner's billing seam is therefore a MUST-HAVE gate: no user-facing turn until every turn books cost against the Leo Chat track and the spend gate is asked before serving.
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• Carol, Sam and every other agent chat verified unchanged on the Codex lane. Runtime is the restricted skills-only sandbox.
• NOT DONE, and the reason this stays OPEN: verify-by-doing caught BOTH remaining seams. (2) A zero-cap day exception did NOT refuse the next turn - the Claude CLI path carries the operator lane's exemption, which Leo's chat must NOT inherit (Ninad: exemptions are per track; only the Orion bypass is exempt). Next session: find where the money gate exempts the claude provider, scope the exemption to the Orion bypass TRACK, wire CLI usage into the track ledger, and re-run both proofs plus the over-cap refusal criterion.
• The generic agent-chat track (other 15 agents) keeps its existing allocation unchanged - flagged for Ninad's next ruling.
• Ninad rulings for the runner (recorded in design v1.1): OS-level project jails (per-instance OS identity, kernel-hard boundary - a subscriber admin changes everything in THEIR project, nothing in Carolverse); Carolverse-admin mode = the Orion runtime behind chat, unlocked only by per-conversation step-up auth; gates are VM-AGNOSTIC (registry-declared, provisioner-converged, container-portable); and WHERE a project runs - carol-vm or a future project VM - is the blueprint service's own placement decision, which the gates must survive unchanged.
• Ninad ruling: implement the jail with GLOVER as the pilot - the second project after carolverse and the FIRST project ON carolverse (the platform's first customer project). Registered under DWARF/Denken Labs pending his word on a separate Glover account; subscribed to blueprint on experimentation; Ninad holds a glover contributor instance mapped to Leo - the multi-instance model live in practice. NEXT (this initiative): Radagast provisions the glover OS identity + jailed workspace, the runner launches sessions as that identity, then the billing seam + exemption scoping + admin step-up mode, in that order.
• RESUMED by CLI-244 on Ninad's instruction (continue the build: clean OS-level segregation across projects; each project admin does all admin tasks on their own project). Continuing CLI-243's open execution 1412 per the ruled build order: registry-declared jail (project_os), Radagast provisioner op, glover pilot identity, kernel-boundary proof; then runner-as-identity, billing seam, exemption scoping, over-cap proof, admin mode last. Also adding the ADMIN role to project membership per today's instruction.
• NINAD RULING (CLI-244): do NOT implement glover further for now. The jail MECHANISM is proven and stays: registry-declared (project_os), Radagast-provisioned, kernel-boundary verified on the glover pilot identity (denied everywhere in Carolverse, free in its own home, zero sudo). Glover stays dormant - no runner, no serving, no billing wired. STILL OPEN on this initiative: the Claude-turn billing seam, operator-exemption scoping, over-cap refusal proof, the instance runner, admin mode (last). Lesson for the provisioner: a sudoers drop-in must sort AFTER the operator catch-all (zz- prefix), and the Albus sudoers wrapper rightly refuses to arm non-radagast identities - session-lane grants are a root-installed baseline until a sanctioned seam exists.
• NINAD RULING (CLI-244): Ninad is the DEFAULT ADMIN of every project created in carolverse. Encoded as cookbook 1280; enforced in the ONE project-creation composer in the shared project model (admin instance created with the project; adminless creation refused; idempotent - proven live on glover with no duplicates); design #542 addendum recorded. Existing projects already carry the admin instances.
• Leo external chat lane = Codex/GPT (fresh Ninad ruling 2026-08-12, CLI-245) — The Claude Code choice worked only by riding the operator Claude Max login through the pre-jail umbrella identity - unlawful under the Claude reservation (589/590/1174) and dead once the project jail + INI-3789 credential scoping took effect (claude CLI as carolapps: Not logged in). Ninad re-ruled: Codex/GPT per the chat law (1077). Track agent-resources-leo-chat re-tagged codex/codex-gpt-5.6-sol; proof call as carolapps returned ready with usage model gpt-5.6-sol booked. The app also hard-sets HOME to the operator home in its env block - dead code now, this initiative should remove it when it resumes. (ninad)
• Claude Code lane UNBLOCKED again (supersedes today CLI-245 Leo->Codex switch) — CLI-245: the reason Leo was moved to Codex this morning - the serving platform had no Claude login it could read once the operator home was sealed (INI-3789) - is now REMOVED. A dedicated shared Claude login home exists that the platform identity (carolapps) reads via group, and the provider fence now FOLLOWS THE TRACK (a caller whose track declares claude passes; CAROL-INI-3792, core-installed). Proven: as carolapps, leo-chat resolves to claude/claude-fable-5, fence_ok, and a real call booked claude-fable-5. Ninad ruling reaffirmed (CLI-245): Leo = Claude Code (agentic instance), Carol/Sam = plain Fable chat completions. Leo track kept on claude. REMAINING on 3788 = the instance RUNNER + ADMIN MODE (reach follows the caller project+role; Carolverse the only project, Ninad the only admin per cookbook 1280): the runner invokes agentic Claude Code in the caller project workspace/jail with the tool tier for their role, turns billed to the Leo Chat track. These require privileged ops (provision, core-install, restart) - build them via the 3788 flow. (orion)
• Guardrail 1: LOGIN dictates access level — CLI-245: the signed-in identity + how it authenticated decides the tool tier. Default = skills-only sandbox for any web session (consumer/contributor). The Carolverse admin (Ninad) reaches the full operator/VS-Code runtime ONLY behind a fresh per-conversation STEP-UP sign-in bound to his identity (design 543 v1.1); a plain web session never unlocks admin tools. Role resolved from project membership (admin>contributor>consumer, cookbook 1280). (ninad)
• Guardrail 2: billing the CLI route to the BLUEPRINT EXPERIMENTATION track — CLI-245 REFINES design 543: while the coding-agent-instance serving is in experimentation, each Leo CLI turn books its cost to the blueprint service Experimentation track - NOT the Leo Chat track (which stays for the plain chat reply). This isolates the experiment's spend. Design 543 updated to record the experimentation-phase billing target. (ninad)
• Closes the untracked-spend hole noted on 3788. (ninad)
• [status-router] executing -> reviewing | event=dispatcher_transition | dispatcher state change (ds-s1)
• [rework-plan] reviewer rework (phase 2) added 5 step(s): Address: A recorded design covers the runner: sandboxed tools, session-per-proje; Address: The dated operator exceptions this serving model reverses are recorded ; Address: A working Claude Code-served external Leo chat turn books its cost on t; Address: The runner abstraction admits other coding agents (Codex next) without ; Address: The Leo Chat track keeps enforcing its budget cap on Claude Code: the s (ir-s1)
• [status-router] reviewing -> executing | event=reviewer_rework | reviewer reopened for rework (ir-s1)
• [delivery-check] 5 pending must-have criteria stamped met at bypass_end on live re-performance evidence (CAROL-INI-3020): test test_ini3788_leo_runner.py: PASS (5 passed in 2.45s) (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• A recorded design covers the runner: sandboxed tools, session-per-project-instance, identity and grounding injection, and the billing seam that books turns on the Leo Chat track (must_have)
• The dated operator exceptions this serving model reverses are recorded before any user-facing turn runs on Claude Code (must_have)
• A working Claude Code-served external Leo chat turn books its cost on the Leo Chat track and is proven by a real conversation (must_have)
• The runner abstraction admits other coding agents (Codex next) without re-architecture (must_have)
• The Leo Chat track keeps enforcing its budget cap on Claude Code: the spend gate is consulted before each served turn, every turn books real cost on the track, and a cap breach refuses service - proven by a real over-cap refusal in test (must_have)