📖About

2026-08-14 evening: Clara's chat (and every agent chat on the Codex lane under the apps OS user) failed every turn with 'Not logged in' - the shared codex credential had gone stale (the Lane Keeper's copy of 18:24 was a logged-out token) while a working login sat in the operator home. Separately the shared codex home had re-accumulated files owned by two OS users (cache, tmp/arg0, plugins under the apps user inside the operator-owned home), reviving the exact EPERM failure 3644 already cured once. Operator repair tonight: quarantined the foreign files (quarantine-ini3644-20260814 inside the shared home), refreshed the shared credential from the working login, bumped its mtime so per-user seeding fires; Clara proven replying on the operator path.

Root-cause scope for this initiative: (1) WHY the Lane Keeper held/refreshed a logged-out token - make the keeper VERIFY the token authenticates (a cheap probe) before it overwrites the authoritative copy, and refuse to publish a logged-out one; (2) WHY files of a second OS user keep landing in the shared home despite the per-user-home design - find the caller that still runs codex against SHARED_HOME from the wrong user and route it through home_for_user; (3) MONITORING: repeated INI-3644 'failed at the provider' turns produced no alert - Ninad found the outage by using Clara. Wire repeated chat-lane provider failures into Hermione's sweep/alerting so a dead chat lane reports itself; (4) regression tests for the keeper's verify-before-publish and the alert path.

⚖️Decisions

• Elrond's bypass methodology checklist (a reminder, not a gate -- you've got this): 0. File it requested_mode='bypass' (planner-vs-bypass is a deliberate choice). bypass_start REFUSES a non-bypass initiative (CAROL-INI-1846), and the dispatcher only skips the bypass lane when the mode says bypass -- a 'planner' mistag lets Merlin's pipeline grab the placeholder step and block your finished work. 1. Filed as planned status -- let the bypass claim/activate it; never file active. 2. Open the bypass (bypass_start) with your droid id + the remediation answer (remediates_initiative_id=NNN, or remediates_nothing=True). 3. Work the blocks for your work-type: template -> design -> code -> test -> review. Do the real work; record decisions on the initiative as you make them. 4. Reality is recorded for you at close -- code (files changed), each decision, and the twin-review verdict become real activities tied to this initiative and show in the Activity Tracker like a planner run (CAROL-INI-1840). No dummy rows. 5. Keep the initiative status moving; it parks in 'reviewing' and is tagged uat-pending for you at close (CAROL-INI-1836), so the stuck-watchdog leaves it alone until UAT. 6. Close runs the gates (design/architecture compliance + caller-audit). If a gate flags something pre-existing or unrelated to your change, waive it with a clear written rationale -- audit, don't skip. 7. Bypass skips the planner's auto-orchestration, NOT the standards. Same template checklist, same review, same observability as a planner run. (elrond)
• Alerting redesigned by Ninad: Athena daily roll-call replaces the passive failure-counter — A real conversation is the test: Athena talks to each agent daily on her wake; silence escalates to Orion. Requires her consciousness - her Mind droid was paused, resumed by the operator 2026-08-14 (running+enabled, roster confirmed). The INI-3644 log-watcher idea for part 3 is withdrawn; parts 1, 2 and 4 stand. (ninad)
• [status-router] planned -> executing | event=bypass_executing | bypass transition (or-bx-01)
• [HYGIENE GATE apps_registered] skip: work_type=B does not require app registration (orion.bypass)
• [HYGIENE GATE design_filed] skip: no design_id provided (orion.bypass)
• [HYGIENE GATE architecture_compliance] pass: references architecture design #146 (agent-centric modular architecture) (orion.bypass)
• [HYGIENE GATE policy_check] pass: considered: P.01.01.01.11 (orion.bypass)
• [HYGIENE GATE constitution_aligned] pass: soft-default pass; caller responsible for asserting via decision row (orion.bypass)
• [HYGIENE GATE cookbook_entry] pass: cookbook 1313: A silent agent is found by talking: Athena's welfare roll-call + the keeper's verified credential (CAROL-INI-3829) (orion.bypass)
• [HYGIENE GATE logbook_entry] pass: logbook session 379: (orion.bypass)
• Criterion 10496 met — Alerting redesigned by Ninad's ruling: Athena's roll-call escalates silent agents to Orion on Agentbook (operator board at session start); the keeper independently escalates a dead credential. Proven by unit tests + live escalation path machinery. (orion)
• Criterion 10500 met — Built exactly as ruled: roll-call rides Athena's wake (Mind resumed, roster confirmed), real chat turn per conscious agent, silence escalates to Orion, data-driven droid at-rollcall-01. Billing deviation flagged in review: probes bill as agent chat per allocation law. (orion)
• Criterion 10497 met — test_ini3829 8/8 green covering the verify-before-publish gate, the ownership guard, and the escalation path; suite registration 719; neighbour 3644 green. (orion)
• Criterion 10494 met — Keeper publishes only after an isolated probe ACTUALLY authenticates; failed probe never publishes, fails the run and escalates Radagast->Orion (unit tests + live VERIFIED run 2026-08-14 20:16). (orion)
• Criterion 10495 met — Shared home is single-user by directory-owner declaration; every other user routed to its own seeded home; regression guard refuses NEW cross-user writes (legacy pre-freeze debris recorded, root sweep requested of Ninad). (orion)
• [status-router] executing -> reviewing | event=dispatcher_transition | dispatcher state change (ds-s1)
• UAT r1 comment (Ninad, 2026-08-14) — Athena should also check that every agent SUPPOSED to be conscious is actually waking on schedule and doing its thing; any anomaly escalates to Orion. (ninad)
• [status-router] reviewing -> executing | event=bypass_executing | bypass transition (or-bx-01)
• Criterion 10523 met — Wake audit live: consults the health composer, filtered to true anomalies (live run found exactly one - Athena's own pre-resume gap, self-clearing tomorrow), escalation merged, 11/11 tests green. (orion)
• [status-router] executing -> reviewing | event=bypass_reviewing | bypass transition (or-bx-01)
• [status-router] reviewing -> closed | event=operator_signoff | Auto-accepted (CAROL-INI-1859): Orion-initiated, >2 days in reviewing with no objection. (el-srac-01)

✅Success criteria

• The Lane Keeper never publishes a credential that does not authenticate: a verify probe gates the overwrite, and a logged-out token is refused with a visible record (must_have)
• No process writes to the shared codex home from a second OS user: the offending caller is found and routed through the per-user home, with a regression guard on shared-home ownership uniformity (must_have)
• Repeated chat-lane provider failures raise a visible alert through the monitoring chain instead of dying quietly in the app log (must_have)
• Regression tests cover the verify-before-publish gate and the failure-alert path, and the suite shows no NEW failures owned by this change (must_have)
• RULING (Ninad 2026-08-14, supersedes the log-watcher plan for part 3): ATHENA runs the daily roll-call. On her wake she opens a real chat turn with every chat-enabled agent; an agent that fails to answer (or whose lane errors) becomes her ESCALATION to Orion via her Mind escalate action, landing on the operator board. The roll-call bills the consciousness track. Her Mind was resumed (running, in the wake roster) as the precondition. (must_have)
• UAT r1 (Ninad): the roll-call also AUDITS the wake record - every agent supposed to be conscious that is not waking on schedule or not producing thought is an anomaly in the same escalation to Orion; a deliberately paused mind is designed sleep, never an anomaly; a broken auditor reports itself, never a clean pass. (must_have)