📖About

Ninad ruling (CLI-249, 2026-08-13): a certain TYPE of app must be designed a certain way, and the mechanism must BIND EVERY BUILDER, not just the operator - a skill only binds Orion; Forge and the Albus lane never read it. Archon is the Designer responsible for this; today his responsibility is intent without an instrument (design #178 exists, but the close-gate checker grades generic facets and is blind to shared templates - being fixed as 3809). Trigger: the org agent-chat window carries NO class marking, which is how Ninad chatted 'Orion' in the org directory believing he was in the operator window (CLI-249).

BUILD (next session):

1. PATTERN REGISTRY (SST): a new registry table `app_patterns` owned by Archon (agt_020) - columns approximately: key (e.g. chat-window, catalogue-page, wiki-page, admin-surface, monitor-card), name, owning_design (CITES design law by number, never quotes - rule 1227/1228), canonical_renderer (e.g. shared/web_chat.py render_web_chat for chat-window), required_marks (JSON list of machine-checkable marks, e.g. window-class chip present, canon template marker, visit beacon on public surfaces), checker (dotted function name), updated_at. Registry accessors per house pattern; the SST scanner picks it up.

2. APPS DECLARE THEIR PATTERN: apps.pattern column (nullable - not every app has a pattern yet). Backfill the five chat windows (org agent chats + carol + sam + leo + orion = pattern chat-window). Declaration is data, so Carolopedia/catalogue can SHOW each app's pattern.

3. ENFORCEMENT AT THE CLOSE GATE: check_delivery_compliance (shared/app_compliance.py) gains a pattern pass - for each app touched by a delivery whose apps.pattern is set, run the pattern's checker; violations join the same out-of-scope follow-on flow every bypass close already runs. COORDINATE WITH 3809 (filed: the checker must follow shared templates when grading facets) - build on top of or alongside its fix, do not duplicate it. Themis's daily Architecture Compliance Auditor reads the same pattern records (one derivation - rule 1126: one composer, many views).

4. FIRST ENFORCED PATTERN - THE WINDOW CLASS CHIP: the one canon window template (CAROL-INI-3773) gains a mandatory CLASS chip rendered from a new render_web_chat parameter window_class with exactly three values: INTERNAL (org agent chats - neutral/slate chip), EXTERNAL (carol/sam/leo - the existing violet stamp SATISFIES this; keep 3805's look, no double-marking), OPERATOR (orion-chat - amber chip). No window may render unclassed - the renderer refuses or defaults loudly, and the chat-window pattern checker asserts the chip. Extend the canon byte-identity test (regression/test_ini3773.py) - the chip is a sanctioned marker-wrapped divergence like STEPUP/EXTERNAL (strip in normalize, assert presence per class). Browser-verify all three classes render (extend regression/test_ini3808_browser.py or new test).

5. RECORDS: new design (architecture, Archon as agent_ref) for the pattern mechanism; cookbook rule recording the ruling (a typed app conforms to its declared pattern, enforced at close); dictionary term 'App Pattern'; update the manage-service-tracks-style verification habit - the app-builder flow declares a pattern at registration (touch register_app.py to accept --pattern).

CONTEXT FOR THE BUILDER: org window chat pages are rendered in apps/org/app.py chat_page via render_web_chat (no class today); the EXTERNAL stamp is shared/web_chat.py EXTERNAL_UI (3805); the operator window is apps/orion-chat/app.py (3808). The close gate runs in shared/bypass.py bypass_end -> shared/app_compliance.py. Keep the chip OUT of the byte-identity normalize failure path (marker-wrap it). Ownership: patterns are Archon's records; the initiative stays owner=orion (requester rule 724).

⚖️Decisions

• Auto-detected remediation target INI-999902693 from title/description scan (matched CAROL-INI-3773 -> row id 999902693 (CAROL-INI-3773-00: ONE web chat template across Carolverse: Clara's window is ca)); override by setting remediates_initiative_id explicitly at bypass_start. (system-auto-detect)
• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• [status-router] planned -> discarded | event=premise_dead | Intake sweep: this filing references target INI-999902693 which is already closed — the premise is dead, nothing left to build (CAROL-INI-2925). (el-intake-01)
• [INI-3011 FAMILY DEATH, OBJECTIVE UNMET] event=premise_dead took the last live member of family CAROL-INI-3812 terminal while the Outcome Oracle reads the objective UNMET (criterion not met: An app_patterns registry table exists, owned by Archon, holding at least the cha; criterion not met: Apps declare their pattern in the registry; all five chat windows are declared c; criterion not met: The bypass close gate grades every touched pattern-declared app against its pat). This needs a human or RSI decision — refile or explicitly discard the objective. (status-router)
• [status-router] discarded -> executing | event=operator_revive | Operator revival (CLI-251): the premise_dead discard acted on a FALSE auto-detected target — 3812 merely CITES closed 3773 as context ('the one canon window template'), it does not remediate it. Objective is UNMET per the Outcome Oracle; Ninad instructed this build (CLI-249 handover: next session's first job). Target cleared in the same correction; bypass will declare remediates_nothing=True. (orion)
• Operator correction (CLI-251): cleared target_initiative_id 999902693 (closed CAROL-INI-3773) — it was stamped by the filing-time auto-detect from a mere textual citation, and it is what let the intake sweep discard this filing as premise_dead. 3812 is net-new feature work; the bypass declares remediates_nothing=True. (orion)
• [recovery] queue row revived in place — the execution had died leaving status=executing with no live queue row; the step-advance sweep relaunches the current step (CAROL-INI-2981) (elrond.handover_watchdog)
• Archon owns the pattern records as agt_002 — the initiative description said agt_020, which is not Archon's id in the registry; the registry is the SST and wins (rule: use SSTs only). (orion)
• EXTERNAL windows inject NO winclass chip: the CAROL-INI-3805 violet stamp IS the class mark (the spec's no-double-marking requirement), and the renderer refuses a class/stamp mismatch in both directions. (orion)
• The blueprint app-registration copies (services/blueprint and Archon's corrected tools) were left pattern-less DELIBERATELY: their INSERTs stay valid with pattern NULL, and pattern declaration remains a deliberate operator/Archon act, not a blueprint default. Recorded so the propagation question is answered, not missed. (orion)
• SST wiring: the scanner's app card now carries a db_row component pointing at the declared app_patterns row (registry origin key, rule 1227) — no new SST category invented for a first-cut single pattern. (orion)
• [delivery-check] 5 must-have criteria remain pending at bypass_end — delivery FAILED live re-performance; UAT must grade on live evidence, not checklist silence (CAROL-INI-3020): test test_ini3812.py: FAIL (no tests ran in 0.35s); test test_ini3812_browser.py: FAIL (no tests ran in 4.10s) (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• UAT rework r1 (Ninad, CLI-251): the ask is INTELLIGENCE, not enforcement. Archon must hold a pattern LIBRARY in the registry — each app maps to ONE OR MORE patterns; each pattern carries a detailed description of how such an app is built, its colour schemes, UI design, the UX the design produces, and typical use cases (Ninad estimates ~20-25 patterns across the ~91 apps). At build time the right pattern(s) are chosen from the app's requirements and their guidance flows into the app-build skills, so a new app comes out recognizably Carolverse WITHOUT the admin spelling it out. The standalone enforcements (close-gate pattern pass, Themis daily audit pre-pass) are NOISE — remove them. Keep the window-class chip + its regression tests (shipped product fix). Trust-first per the remove-defensive-checks standing rule. — Ninad: 'this is an intelligence issue; the solution needs to address the capability gap, not the enforcement gap' (ninad)
• [status-router] reviewing -> executing | event=bypass_executing | bypass transition (or-bx-01)
• [recovery] queue row revived in place — the execution had died leaving status=executing with no live queue row; the step-advance sweep relaunches the current step (CAROL-INI-2981) (elrond.handover_watchdog)
• [status-router] executing -> reviewing | event=dispatcher_transition | dispatcher state change (ds-s1)
• [rework-plan] reviewer rework (phase 3) added 5 step(s): Address: An app_patterns registry table exists, owned by Archon, holding at leas; Address: Apps declare their pattern in the registry; all five chat windows are d; Address: The bypass close gate grades every touched pattern-declared app against; Address: Every chat window renders a class chip - INTERNAL on org agent chats, E; Address: Canon byte-identity still holds with the chip marker-stripped; a browse (ir-s1)
• [status-router] reviewing -> executing | event=reviewer_rework | reviewer reopened for rework (ir-s1)
• The 23-pattern taxonomy and every app->pattern mapping were derived from OBSERVATION (four parallel analysts read every app's actual UI code), not invented; the five unbuilt stubs (carol-admin, carol-monitor, clara-monitor, elrond-monitor, session-induction) are unmapped because a stub has no pattern to observe. The map doubles as the live-exemplar index so guidance always points at real reference builds. (orion)
• [delivery-check] 5 must-have criteria remain pending at bypass_end — delivery FAILED live re-performance; UAT must grade on live evidence, not checklist silence (CAROL-INI-3020): test test_ini3812.py: FAIL (no tests ran in 0.49s); test test_ini3812_browser.py: FAIL (no tests ran in 4.17s) (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• An app_patterns registry table exists, owned by Archon, holding at least the chat-window pattern with its owning design cited by number, canonical renderer and machine-checkable required marks (must_have)
• Apps declare their pattern in the registry; all five chat windows are declared chat-window (must_have)
• The bypass close gate grades every touched pattern-declared app against its pattern's checker, and violations flow into the existing out-of-scope follow-on lane (coordinated with 3809, not duplicating it) (must_have)
• Every chat window renders a class chip - INTERNAL on org agent chats, EXTERNAL (the 3805 stamp) on carol/sam/leo, OPERATOR on orion-chat - and no window renders unclassed (must_have)
• Canon byte-identity still holds with the chip marker-stripped; a browser test proves all three classes render; a new design + cookbook rule + dictionary term record the mechanism (must_have)