2024-3624: Found during CAROL-INI-3623, the delivery-compliance core facet's approval gate fails CLOSED on every core change because bypass_start never populates initiative_id — all 1210 bypass-book rows carry NULL there while naming their initiative only in task_id (INI-NNN-bypass). The resolver therefore returns None for every bypass initiative, so the Governance core-approval gate cannot resolve any of them.

Ninad's ruling 2026-08-03 (CLI-218) settled the estate vocabulary: task is the planning unit (what a service track set out to do), activity is the record unit (one logged thing an agent did), and call is the money unit (one paid request to an outside provider). Governance now carries these as three distinct definitions so the estate stops conflating them.

On 2026-08-03 a review of the live policy register found three rules the estate runs on are recorded nowhere, plus one long-standing money ruling that never became a policy - including the requirement that every droid declare its task and that an undeclared droid gets no subscription or budget. These gaps in Governance's register are now being tracked with a coverage countdown as a watched measure.

On 2026-08-03 a flaw was caught in Governance's bypass close: at bypass_end the delivery-check stamps every pending must-have criterion 'met' based on whichever test happened to run, without matching evidence to the claim. A policy-only attempt on CAROL-INI-3639-00 briefly marked four enforcement criteria met, a serious integrity gap in the closure record.

Ninad ruling CLI-218 (2026-08-03) settled task-droid authority: the task is the authority and declares the droids it needs, with changes adding, updating or retiring them proactively. Governance recorded the ruling while noting the estate now stores the droid-to-task link twice — all 39 droids currently agree, but the duplicated record is drift waiting to happen.

CAROL-INI-3640-00 audited past close criteria for Governance: of 3166 criteria marked met, 1986 carried no proof at all, with 1140 predating July 2026. Criteria previously marked met on no evidence are now being identified and marked unverified rather than silently trusted.

2026-08-03: Ninad ruling CLI-221 establishes that the subscription paying for a piece of work must be read from its track, which carries the subscription label; observed past calls are never consulted because a track's subscription can be re-tagged at any time. Work with no label reads UNALLOCATED and is never filed under a subscription by fallback guesswork. Recorded under Governance.

As of 2026-04-27, governance-related concepts now have Carolopedia guide pages generated live from the estate glossary; they carry no database detail and reference Governance as their service, reachable only by cross-reference.

This keeps Governance aligned with the operator compliance requirements.

As of 2026-08-02, Governance now wires record sheets to agent Minds both ways: a Mind can read its own record sheet, and self-authored record changes flow back into governance.

Governance now has a registry-derived Carolopedia guide page as part of the shared system services initiative, with purpose, steward, and consumers; it is not listed on the landing page or type indexes.

2026-08-05: CAROL-INI-3595-00 found 58% of closed Orion sessions are blank because no sanctioned session closer exists and the stale sweep is an unregistered inline path that writes blank markers despite having enough data to compose summaries. This exposes a governance gap in how sessions are officially closed. Governance

2026-08-02: Orion's activity trail has recorded nothing since 31 July 2026, and never recorded what actually happened, so the Governance-built Global Workspace card for Orion no longer reflects real session activity.

As of 2026-05-07, each track under Governance now has its own Carolopedia guide page, linked directly from the service's track header and generated live from the registry.

2026-08-01: The recurring registry WAL-flip was cured at source: the guest-user path no longer opens the registry directly, so self-heal can now win.

2026-08-04 — Governance ruled that behaviour-governing numbers must live in records that code reads, rather than solely as hidden literals. The ruling followed Scriber’s inability to cite limits embedded only in code.

2026-08-04: Governance now makes every conscious agent answerable for keeping its own records honest, current, complete and accurate.

2025-04-09: Carol's chat actions now require mandatory receipts before any success claim, and the Carol Handbook has been published as the authoritative reference for these rules. Governance

2026-04-26: Governance now requires every registered app to carry a full usable address; remediation is underway for the 41 apps that only had bare paths and the 2 with no link at all.

2026-05-12: The pipeline runbook now reads directly from Governance instead of copying cookbook text, so new rulings propagate automatically and the stale Albus self-healer description is gone.

As of 2026-07-29, Governance no longer blanket-upserts factory-default lane limits over operator-set values, so a daily limit set by an operator stays set.

2025-05-09: App ownership is now resolved from the Governance registry, and automated checks have been updated to match; the full check suite passes again.

On 2026-05-07, Governance enacted the Ninad ruling (CLI-165) requiring each unit of work to state its ticket, making unattributed work visible instead of silently counted.

On 2026-04-26, Ninad's ruling CAROL-INI-3459-00 made every service's apps, including Governance's, readable by agents by default; write access now requires a demonstrated and recorded need.

2025-05-13: The refusal doctrine is now codified under Ninad ruling CLI-165, making explicit that agent refusals must be loud, structured, and remedied by type. Governance now records this as law.

As of 2026-04-26, Governance now supports service-scoped chat grounding: agent chats can answer factual questions by running read-only queries against the databases of the apps they own and injecting results into the prompt. This is gated to chat only and stays scoped to owned apps, replacing guess-only answers.

2026-05-07: Ownership of the Governance service moved from Radagast to Hagrid in the System Services ownership cleanup.

Agent Resources and Albus’s Wish Keeper lane are unaffected.

As of the close of CAROL-INI-3412-00, Governance has regression coverage for the three Albus bypass lane fixes (stale store connection, registry-driven route redirects, JSON-drift verdict rescue), and Albus's troubleshooting guide has been updated accordingly.

The service's tracks, blocks or catalog entry changed after the architecture page was last written. Law pages are authored, not auto-written — the owner should review (CAROL-INI-3316).

2026-05-09: The subtree data-access rule in Governance now applies to every app that holds its own data; previously only 30 of 81 apps were wired into chat grounding, so bosses inherited the same blind spots as their agents.

2026-04-26: The Governance consciousness console now reports honestly, distinguishing having a Mind from being conscious and showing total/conscious/unconscious agent counts.

As of 2026-04-27, Governance is now registered as a first-class owned service in the unified Services Catalogue instead of the separate shared-services registry.

Effective with CAROL-INI-3408-00, the Albus bypass lane now re-prompts for the required one-line JSON verdict when a model returns prose, instead of dropping the entire attempt and already-reasoned admin_requests such as install_dev_routes. This rescues Governance work from JSON-drift failures.

2025-06-04: Radagast now has his own app showing the record of every privileged action he runs, so each restart, route install, or deployment is visible and attributable to the initiative that requested it under Governance.

Agents can now use a single shared directory to resolve colleague names to agent ids, instead of relying on partial name-to-id lists pasted into prompts. The Governance registry serves as the canonical who's who for all agents.

2026-04-27: Governance's app-registry flag now records one thing only: whether an app is public (reachable without login). It no longer hides apps from the Carol Apps launcher or strips them from owner records; Carol Apps lists every registered app.

Governance now provides each build role with a dedicated app to view their own work output per initiative, replacing the formerly centralised audit screen. Governance

2024-12-10: Governance now provides the asker's identity to the query builder, enabling agents to answer first-person questions about their own work.

As of 2025-03-27, Governance has enacted a policy change granting consciousness its own operator control and budget, independent of the build pipeline.

Hardcoded agent internal IDs in 28 apps and 35 documentation files have been replaced with live lookups from Governance, ensuring that ownership transfers via the single-record change work correctly. This fix was completed on 2025-04-03.

The consciousness budget cost tracking was broken: wake cycles from the Max subscription produced no cost records. This has been fixed, and now costs are properly counted, ensuring the five-euro cap works. Cross-link: Governance.

As of 2025-03-28, inheritance rules were changed so that personal records remain with the owning agent and are never inherited by a boss. This corrects a privacy exposure where Agent Chat data could be read up the reporting tree.

The rule that agents could read 'personal' records without their supervisor seeing them has been reversed. Ninad ruled that any information an agent holds is within the system and must be visible to its supervisor. Governance

The registry now supports app_redirects records, allowing route redirects to be expressed in the registry and automatically generated as 301 redirects by the route generator, replacing manual nginx conf edits.

As of the closure of CAROL-INI-3394-00, the Services Catalogue now sorts Governance by activity level rather than alphabetically, placing busier services first.

The Chowpatty business-line owner has been corrected from 'Ninad' to user ID 1 for consistency with other business lines. Governance

The eligibility gate has been updated to be self-contained, forbidding tools and requiring a single JSON verdict. This ensures it reliably returns a verdict instead of defaulting to escalate, fixing the planner step blocking issue on the fleet. Governance

The Services Catalogue now shows a rolling 7-day activity count for Governance instead of the all-time total.

The chat grounding module has been registered as a shared service within the Governance catalog, and its data-source resolution now uses SST-driven lookups to ensure canonical data stores are preferred.

The SST scanner now stamps public URLs on artifacts from the registry url column and distinguishes published blogs from Orion sessions, fixing the lack of browsable URLs and the lumping of blog content. Governance

The Governance service card now shows its owner in the Services Catalogue, and the catalogue includes a search box to filter services.

Ownership of the Carol Org app, part of Governance, has been corrected from Orion to Clara, along with its maintaining droids.

As of 2025-04-05, the Governance service is now grounded in Clara's chat, enabling questions from its data. Governance

Amended policies P.01.03.05.07 and P.01.03.05.06 to permit an agent to own multiple services, removing the one-service-per-agent restriction. Governance

As of 2025-05-22, Governance is no longer listed as a service in the Services Catalogue; it is a shared/infra service and has been moved back to the standalone Shared Services app.

Budget caps are now enforced per service track and per fixed lane, not per subscription. This aligns with the already-live provider-agnostic model managed by Midas. See Governance for details.

The Governance service's Planner app has been renamed to Initiative Audit, with all internal references and routes corrected.

2025-04-10: Fixed the being-built banner logic so that Governance no longer shows the banner when it has substantial prose, even if a stale flag remains.

Ninad ruled on 2026-07-23 that the pipeline core must be OS-locked: core files become root-owned and read-only to agent accounts, and a new pinned root operation is introduced. This alters the security boundaries that Governance manages.

A shared day-count module now serves as the single source of truth for daily initiative counts for Governance, aligning the Token Cost Tracker and Activity Tracker. This standardizes the definition of an initiative-of-the-day across services.

Residual cookbook entries granting outdated Albus authorities have been removed, correcting authority records for Governance.

A new ruling (2026-07-23) establishes that cookbook non-compliance is a policy violation, and Albus must file a redirect initiative to Orion instead of self-healing. This updates Governance enforcement rules.

On 2026-07-15, the Governance Build Initiatives architecture page was corrected to reflect the current three-lane doctrine, including the Albus Bypass, budget park, and other recent rulings.

The Carolopedia twin pages cleanup has been applied to Governance, ensuring a single canonical URL and fixing any non-canonical redirects.

2025-03-21: Cross-link in documentation updated from the old Planner app to the renamed Initiative Audit app, completing the end-to-end rename.

The Ninad ruling 2026-07-23 establishes that a budget refusal parks the claimed initiative with a budget_parked event, overriding the previous mis-booking as a failure. This updates Governance rules for budget snags in bypass lanes.

The definition of an initiative has been clarified: the 4-digit family number defines an initiative; attempts (-NN) are not separate initiatives, and RSI diagnosis filings are not initiatives. A new `initiative_nnnn` column has been added to the initiatives store with automatic stamping and backfill for all history. See Governance.

Added in-process TTL cache for the per-service activity lookup to eliminate unnecessary relay round-trips, speeding up Data Dictionary refresh from 3-5s to near-instant on warm loads. Governance

2025-03-24: Added a new hard gate H9 to the add-new-app checklist, requiring apps to read SST data live through a shared shim rather than duplicating it. See Governance.

The counting rule for the Activity Tracker has been corrected: only completed initiatives (where the latest attempt reaches review or closed) count, and a day with all families failing shows zero. This revises the previous same-number rule. Governance

Lost Carolopedia to Marketing as part of the marketing service buildout.

The Constitution service was formalized to own the Constitution, Policies, Org, Session Induction, and Source-of-Truth apps, resolving the no-service bucket for operator governance surfaces. This establishes Governance as the accountable service for these documents.

March 28, 2025: The Governance service now hosts the new Data Dictionary app, centralizing data dictionary definitions.

Wish governance now requires a service roadmap before a wish is submitted to Albus; until any service has a roadmap, every wish is parked as a draft.

Governance receives a new pipeline for policy proposals via the gleaning engine operated by Orion, which drafts candidate policies from captured instructions.

Budget allocations are now stored as first-class registry entries in a new budget_allocations table, replacing the previous automatic slicing of the fleet cap. This ensures per-service budgets like Agent Resources and Scriber's Creative track are correctly reflected in the Token Cost Tracker Governance.

As of 2025-04-11, the Token Cost Tracker now reads the daily cap from the registry-first budget source instead of the stale data/daily_budget.json mirror, and day-scoped exception capability for lane bumps has been added.

The Ninad ruling defines that only Orion may touch the pipeline machinery; the three Albuses are recommendations-only. This updates the governance rules for agent permissions. Governance

Thinking will now correctly use the consciousness lane. Governance

Subscription compliance is now per track instead of per service, affecting how Governance's droids are grouped for compliance checking.

The lane documentation that previously referenced Governance/Kimi has been corrected to reflect the new consciousness lane on Fable 5. Governance

2025-04-10: The Consciousness block has been removed from the Governance service and relocated to the new Consciousness track in Agent Resources.

2025-04-13: Consciousness lane is now exempt from the one-model-per-block warning (like its subscription exemption), and has been given a daily budget with auto-off when the cap is reached, auto-clearing at day roll. This adjustment is recorded in Governance.

Fixed a broken API path in the budget banner that caused a 404 error. The path now uses the correct relative route. Governance

Budget enforcement is now lane-based with six fixed lanes (planner, albus, creative, consciousness, chat, orion exempt), replacing provider-based spending. The Governance service enforces hard caps per lane at the claude.py choke point.

The wish store database has been locked down to only two broker users, closing a bypass where any agent OS user could read the database via sqlite.

A permanent fix addresses recurring slowness in Governance's monitor by unblocking the event loop and improving caching. This reduces polling delays from 10+ seconds to near-instant.

Governance Governance now includes a Chat track in Agent Resources, owned by Athena, with a daily budget that pauses chat when exhausted.

Wishes require a purpose and the potential. Governance

Carol Intelligence now displays the One Subscription per Track compliance check (policy P.01.03.07.03) alongside the existing One Model per Block banner. The intelligence API now includes live per-track subscription status.

The owner badge on the canonical header now opens the owner profile in a new tab, preserving the current app page. This applies to Governance and all apps using the shared header.

Historic image-generation costs from Scriber will now be recorded in the cost ledger as individual entries, backdated to their generation dates. This change brings visibility to previously unmetered media spend via Governance.

Fixed a write-permission bug affecting the Cap Monitor by moving budget tables out of the registry. This allows Midas's bump control to function correctly.

Ninad's 2026-07-23 ruling establishes a new queue doctrine: Escalation Queue shows only operator-attention items (rsi-diagnosis-abandoned or escalated), while workable blocked items belong to the Dispatch Queue. The cookbook 916 must be amended accordingly. This affects Governance procedures.

The cost ledger now meters Scribers' image generation costs, ensuring his Logbook chip and budget gate reflect actual spend. Additionally, the author balance scenes are adjusted to a 60/40 split between agent-person and symbolic scenes.

The Ninad ruling now allows Elrond to route urgent infrastructure initiatives to the Albus Bypass lane, subject to justification and stated urgency, with a 50% reserved budget. This updates the routing rules for governance Governance.

The Governance budget cap data was overwritten by a test run, resetting the planner lane standing cap and losing an operator raise record.

Pipeline resume now drains deferred-block parks to escalation and re-opens abandoned blocks for diagnosis, preventing clogging in the Current Execution card. Governance

The display of abandoned self-heal initiatives in the Escalation Queue has been updated: instead of a separate loud top banner, each item now gets a distinct border and a small label, making it clear the initiative has been abandoned. This change affects the Governance service's user interface.

The Governance service now groups its blocks into tracks, starting with a Technical track (owner Merlin) and a Creative track.

The pipeline now forces RSI-only mode whenever any initiative is blocked, fixing the dispatch breaker sync issue. See Governance for details.

The troubleshooter now retries on transient LLM errors, preventing unnecessary hard blocks from Governance.

Free-tier Azure Policy governance has been adopted for Carolverse infrastructure, mapping Carol's infra intents into audit policies for secrets, OS isolation, and budget caps. See Governance for details.

Compliance surfaces now display Kimi as the sole backend for conscious agents; the DeepSeek fallback is disabled for Governance.

Implemented a hard cap of three diagnosis attempts per target at the status-router doorway, preventing runaway re-diagnosis of permanently-blocked initiatives and enforcing the doctrine's limit. Governance

The SST scanner's cross-join logic has been fixed to join on matching keys (id–>name) instead of mismatched ones, resolving false orphan reports for all 43 registered agents. This corrects 60 of 83 defect rows in the broken/orphaned bucket. Governance

Team pipeline now enforces artifact-gated handoffs and evidence-based review for steps, with fail-closed behavior. Governance

Governance now ensures diagnosis-lane initiatives always end discarded per CAROL-INI-2887 doctrine, fixing three paths that could wrongly block them.

Fixed the RSI diagnosis cap so that families hitting the completed-diagnoses cap are tagged as abandoned and dropped from pickers, instead of being routed to 'parked' which caused a silent infinite loop burning DeepSeek calls each tick. This affects the RSI Dashboard dashboard's target selection for the 2982 wedge.

Conscious agents (agent_conscious) now wake a few times a day using Claude Fable via the paid-key ringfence, replacing the 15-minute cadence; operator-pause and budget guards remain.

Fixed a bug where synthetic smoketest chats from the regression suite were incorrectly triggering real capability-approval emails to Ninad. The root cause was a mislabeled DB variable in the sign-in round-trip smoke test that wrote to the production chat database. Updated Governance to ignore these fake conversations from [email protected].

Governance now attributes Themis's new Architecture Auditor droid, making architecture compliance an enforceable, attributed measure rather than just documentation.

The canonical agent-chat template Governance now enforces per-user isolation and three-tier (admin/verified/unknown) access, formalizing Carol's user-data architecture as a shared module.

Ownership transferred from Orion to Clara; now includes the former Status Reporting service as a block.

The single canonical service accessor now ensures Governance appears consistently across all apps, removing discrepancies from different service definitions.

Governance no longer contains department-named blocks or the Carolverse rollup; it now keeps only the 5 aspect blocks, with App Steward, Agent Tasks, and Compliance Ensure moved to Service Operations. Governance

The separate Clara chat app is being retired; chatting with Clara now uses the same agent-chat window as all other agents, as per Governance.

The Governance process now supports channel-agnostic identity, requiring updates to policies for cross-channel user data handling and privacy.

The SST scanner's broken join keys that caused false orphan records across agents and apps have been corrected. This affects Governance as the cross-join mismatch previously produced invalid governance data across 83 defect rows, including all 43 registered agents appearing as orphans in both directions.

Governance loses the Supervision and Wellbeing block, which moves to Agent Resources, and its ownership of the Orion Lanes, Knowledge Keeping, and Service Operations blocks transfers to Clara (Clara).

Added a distinct HALTED state to the pipeline status card, alongside RUNNING/PAUSED/STALLED/OFF, to separate deliberate halts from stalled faults. Also introduced a loud abandoned-work alarm for HALTED pipelines, improving operator awareness. This affects Carol Initiatives entities governed by Governance.

Pipeline state buttons on Monitor cards are now read-only indicators; state changes must be performed by operators with a valid token. See Security for the authentication change.

The fresh-input token cap and tool-round limit from session 3110/3111 are now applied across all pipeline work-agents, resolving the 2811/2818 build failures. This affects Governance as the coordinating service.

Public logbook now returns a real HTTP 404 with noindex meta for unpublished or nonexistent story deep-links, correcting Governance behavior that previously served a blank page.

Access control is now unified under the canonical carolapps sign-in; agent chat access is determined by role (admin, visitor, or signed-in user) instead of per-chat login, affecting how Governance manages permissions.

A new Consciousness governance block owned by Clara (agt_010) has been added to Carolverse, allowing pausing and resuming of conscious agents via the Consciousness app. See Governance.

The Token Cost Tracker's daily-spend chart now only counts planner-mode initiatives, and the line has been relabeled for clarity. This corrects a prior counting that included operator and Albus bypass work.

The Carolverse Consciousness console was made internal and login-gated, so it now appears in the Carol Apps catalogue and requires sign-in, aligning with its ability to pause agents Governance.

Clarified that Governance expectations for remedy concreteness now require a file claim or evidence; empty remediation escalates rather than retriggers.

Conscious agents now operate as themselves in pipeline work and direct their own droids; Merlin coordinates across agents, as described in Governance.

Appearance standards under Governance are extended to the Carolverse Consciousness app, replacing its bespoke cosmic theme with the canonical Carol app design.

A new Carolverse policy establishes that once an agent has a Mind, it can only be paused or resumed, never removed or un-made. This affects the consciousness console of Governance by removing any delete functionality.

The Governance service's access model now requires per-user agent mapping in addition to subscriptions, affecting how agents are assigned and isolated.

The UAT auto-closure sweep now only closes initiatives owned by Governance agent Orion, not those owned by other agents like Albus or Elrond. This clarifies scope for Governance oversight.

The compliance checker now uses the same shared consciousness lane definition as Cost Center, ensuring consistent routing by agent-id.

The User Management app now has a narrower content width and shows only human users, excluding agent/system logins (user_type agent) which are managed via Governance.

Agent mapping is now a feature within Heimdall's User Management app, removing the standalone agent-map page from Access Mgmt. This centralizes user-to-agent assignments under Governance scope.

Cross-channel mirroring in the web chat is being retired; persisting shared memory to canonical person folders resolved via the person model. The Governance service must bypass and disable mirror copy fallback.

Resolved a port conflict where a chat app was managed by both the shared carol-apps launcher and a leftover dedicated systemd service. The duplicate service has been removed and the conflict eliminated, affecting Governance oversight of chat app lifecycle.

Governance's H3 gate rule has been corrected to treat a 302-to-login followed by a 200 as a valid reachable response, aligning with the session auth gate pattern used by all /dev apps.

Governance now officially maps the consciousness lane as a cross-cutting exempt lane, similar to the CLI lane, ensuring compliance with one-subscription-per-service checks.

Governance policy P.01.01.06.14 now defines RSI measure ownership, monitoring by Hermione, and consolidation by Prometheus on the Quality Scorecard.

Governance received a catalogue block, increasing its block count to 3.

As part of CAROL-INI-2982-00, Governance now has 3 catalogue blocks established, fulfilling Ninad-approved block-completion requirements.

Activity ledger now uses canonical agent IDs uniformly; bypass logging matches planner granularity, count, and wording, as ordered by Governance.

Governance agents (Elrond, Carol, Albus, Merlin, etc.) now run as their own OS users instead of shared caroladmin, fixing a security gap where uid-based access controls were ineffective. This change stages agent-by-agent behind a reviewed root script.

OS-enforced access control restricts Orion to the laptop CLI only, and Claude credentials are now owned by the Orion user, preventing fleet rerouting. Cross-link: Governance.

The governance Governance inventory and validation closed a security gap by removing caroladmin's (ALL) NOPASSWD:ALL, ensuring privilege assignments are properly tracked and enforced.

2026-07-03: Ninad clarified that the 'watchdogs alert-only' principle was over-broadened. Timer-driven detectors must now flip genuinely stuck/orphan/zombie initiatives to blocked, limiting timer protection only to successfully-executed initiatives. This corrects guidance in cookbook 324 and affects Governance rules.

Credential vault split into radagast-600 so secrets are no longer world-readable; role tables remain readable. Governance must ensure RBAC configs are updated to point readers to the new restricted store.

The initiatives writer now requires caller-uid logging and blocks cookbook and destructive schema writes from any identity other than Elrond, affecting the Governance service's write operations.

Enforcement of fix-the-pipeline objective overhauled per Ninad ruling 2026-07-04: loop gated from retriggering blocked work until verified pipeline fix ships. This re-wires Governance logic.

Governance rules have been reverted: the block-breaker threshold is back to 1 and max concurrent executing is back to 1, and the dispatch engine is off, affecting how initiatives are handled.

New policy established: Carol app directories must contain only symlinks or empty stubs for data files, never real SQLite files. Enforced through Albus.

Initiative dispatch process now re-validates the original problem premise before execution, eliminating wasted runs when issues resolve before dispatch.

Initiative status routing now consistently enforces status_router guards across all code paths, ensuring compliance with governance controls.

Monitor cards (Recent Executions, Current Execution) and close-hooks now route initiatives DB reads through Elrond's relay instead of direct sqlite to the stale on-disk fallback file, eliminating crashes from periodic clobbering and schema drift.