📖About

Ninad ruling (CLI-244, cookbook 1281): nobody except Orion uses the caroladmin login; each agent has its own OS id. Found in drift: all 87 scheduled jobs run from caroladmin's crontab in one shared trust domain — able to read the operator's Claude Max/Codex login homes (how the Albus bypass lane silently rode the reserved Max) and write the entire dev tree (the Aug-6 lane-switch engine destruction was caroladmin-level write damage). Violates P.04.01.06.01, P.01.03.02.10, P.03.04.02.01 — the law exists; the estate drifted. Cure: migrate the scheduled fleet onto the 40 provisioned per-agent identities (per-agent crontabs or systemd user units; file permissions widened deliberately per surface, never by sharing caroladmin); scope the operator credential homes to Orion alone; add Themis's drift sweep asserting every scheduled droid runs as its owning agent (a red check on any caroladmin-owned agent job) so the drift can never be silent again. The Albus bypass runner moves to the albus identity with its model lane decided by fresh operator ruling (its Claude exception expired 2026-08-09).

⚖️Decisions

• Mode planner->bypass — Ninad instructed Orion to pick up this initiative directly (CLI-245, 2026-08-12); pipeline is OFF so the planner lane cannot run; standing rule routes all Carol initiatives via bypass until the pipeline is self-hosting. Ninad also added two requirements this session: per-asset rights per agent login, and the droid-move procedure must carry logic across logins. (orion)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• Albus bypass runner lane = Codex — Ninad ruling 2026-08-12 (CLI-245): per allocation law (cookbook 1174 rule, 1220) the Albus bypass belongs on Codex; the expired Claude Max exception is not renewed. Runner moves to the albus OS identity on the shared Codex lane. (ninad)
• Service fleet = follow-on initiative — Ninad ruling 2026-08-12 (CLI-245): CAROL-INI-3789 scope = scheduled fleet + operator credential scoping + Albus runner + Themis sweep. The ~65 systemd services running as caroladmin migrate under a follow-on initiative; Themis sweep reports them as visible drift meanwhile. Criterion 10317 amended accordingly. (ninad)
• Root substrate script approved — Ninad approved and ran tools/root_scripts/ini3789_os_identity_substrate.sh as root in-session (2026-08-12). (ninad)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• Post-close incident: long-lived services needed a bounce after the group change — ~2h partial outage 2026-08-12 (Agentbook down, agent-data apps 500ing): processes started before the substrate held pre-change group lists, so the new agent-dir ownership (2770) locked them out of agents/ folders. Cure: restarted carol-apps/carol-carol/carol-agentbook via Radagast; all ports green. LESSON for 3790 and any future group change: a supplementary-group change is invisible to running processes - bounce every long-lived service in the same window. Monitoring note: the outage was reported by Ninad, not the monitors - and the primary alert channel (Agentbook) was itself the dead app; the Gmail fallback did not surface it either. Monitoring-gap check belongs in 3790 scope. (orion)
• Agent code dirs: read stays open inside the fenced tree; write stays owner+build-lane — Leo Chat outage 2026-08-12 ~13:10-15:0x: the apps umbrella runs as the carolapps platform identity (project-jail drop-in), not caroladmin, and the 2770/o-rwx agent dirs blocked it from importing agent code (ModuleNotFoundError masking a permission denial). Cure applied per-agent VIA EACH AGENT'S OWN IDENTITY (role-exec): dirs 2775, files o+r; write remains agent+carol-build only, so the write-exclusion criterion stays intact. The root helper carol-own-agent-dir still writes the old tight modes - Ninad to apply the two-line fix (staged root script already updated) so future moves do not re-tighten. (orion)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)
• Orion remediation in progress: INI-999902794 bypass opened — CAROL-INI-696: an Orion-driven bypass has been opened to remediate this parent. The canonical Orion remediated: marker will be posted on close — see cookbook 156 / 155. (shared.bypass.bypass_start)
• Orion remediated: INI-999902794 bypass closed — CAROL-INI-696 close-marker: the Orion bypass INI-999902794 filed against this parent reached terminal state (closed). This row's literal prefix Orion remediated: is the canonical signal the cookbook-155 dispatcher gate looks for. (shared.bypass.bypass_end)

✅Success criteria

• Zero agent-owned SCHEDULED jobs remain in caroladmin crontab: every scheduled/triggered droid runs under its owning agent OS identity, verified by an independent read of the installed crontabs and by run-audit rows landing under the new identities. (Ongoing/service fleet: follow-on initiative per Ninad ruling 2026-08-12; Themis sweep reports it as visible drift meanwhile.) (must_have)
• The operator's model credential homes (Claude Max, Codex operator login) are readable by Orion's lane only — no agent identity and no shared group can open them. (must_have)
• A registered Themis sweep turns red when any agent droid is scheduled or running under caroladmin (or any identity other than its owner), and it is proven red-before/green-after during migration. (must_have)
• The Albus bypass runner runs as the albus identity, on a model lane holding a live operator ruling — no expired exception. (must_have)
• Every migrated droid keeps emitting run-audit rows and Hermione's sweeps still see all of them (no droid goes invisible in the move). (must_have)
• Per-asset rights: each agent OS identity can write ONLY the assets its droids defined tasks require - proven by a permissions check showing an agent identity cannot write another agent assets or the dev tree at large. (must_have)
• The move-droid procedure moves the droid logic with it: after a test move, the droid code, schedule entry and asset rights live under the new agent login and the old login retains none. (must_have)