📖Summary

The Build Initiatives service is built following the [agent-centric modular architecture](https://carolopedia.denken-labs.com/wiki/architecture) of Carolverse. It builds and modifies software through THREE execution lanes — the autonomous planner, the operator's (Orion's) bypass, and the Albus Bypass — each a track of this service with its own daily budget lane, with distinct agent identities carrying out each activity in the pipeline.

📖Functional considerations

This is the front door for all engineering work in Carolverse, so its architecture is shaped by what it must guarantee end-to-end:

- **Three execution lanes, one lifecycle.** Autonomous (planner), operator-driven (Orion bypass) and the Albus Bypass all flow through the same file → plan → execute → review → sign-off lifecycle. One lane = one track = one budget lane.
A budget snag PARKS work (work-in-waiting, auto-resumed when the lane reopens) — it is never booked as a failure.
- **Sub-second incident filing.** A breakage must be filed and surfaced fast, so the incident path skips the expensive AI classification steps.
- **Detect, recommend, escalate.** Failures are detected and diagnosed, but the three Albuses are recommendations-only and self-heal is SUSPENDED — the ONLY actor who touches the pipeline machinery is Orion, working the escalation and core-change-request queues.
- **Accountable and observable by construction.** Every action is tagged to an agent and a doing droid, a security gate authorises each filing, every initiative shows on the Monitor with a deterministic state, and the pipeline machinery itself is OS-locked against agent edits.

📖Solution architecture

The service is organised as **tracks of blocks** — Department → Service → Track → Block — wired together by a small control plane. It is a direct instance of Carolverse's [agent-centric modular architecture](https://carolopedia.denken-labs.com/wiki/architecture): each block is owned by an agent and carried out by that agent's droids.

- **Four tracks mirror the lanes.** *Initiatives — Planner* (Merlin's pipeline blocks), *Orion Bypass (CLI)*, *Albus Bypass*, and the *Creative* storytelling track (Scriber). Budget and cost attribute per track.
- **Two planner layers.** Phase-level planning sequences the work; task-level planning breaks each phase into steps, executed by the build team (Sage → Archon → Forge → Argus) under evidence gates — a step is done only when its stored deliverables prove it.
- **A single mutator.** One **status-router** is the only thing that changes an initiative's status and state together, so the Monitor cards are a pure function of state (executing/parked → Current, reviewing/closed → Recent, blocked/abandoned → Escalation, the single-slot dispatch queue).
- **The Albus Bypass lane** picks up work the self-heal loop abandoned, Elrond-routed URGENT infrastructure (with a reserved half of its budget), and granted temple wishes. A budget snag parks the claim for fleet resume; a real failure hands the target back to the RSI line, hard-capped at 3 attempts before permanent abandonment for the operator.
- **Skills as the unit of capability.** A meta-skill lets the pipeline author and wire a brand-new skill, and a skill-gap healer inserts a build-the-skill step ahead of any step whose skill is missing.
- **A filing security gate** runs at creation: authorisation, role-vs-content alignment, budget and roadmap accountability.
- **The pipeline core is OS-locked** (root-owned machinery, deny-by-default shell guards at all three lanes). Agents refused a core write file a core-change request for Orion — recommend, don't edit.

📖Technologies

- **Python 3** services on **FastAPI** / **Flask**, served by **uvicorn/gunicorn** behind **nginx**.
- **SQLite (WAL)** datastores. The initiatives database sits behind a **single-writer relay** so concurrent droids cannot cause a write-lock storm.
- **systemd** and **cron** schedule the recurring droids; a **flock** serialises ticks and a **separate heartbeat database** absorbs run-audit writes so they never contend with real work.
- **A lane belongs to a TRACK, and the track is where it is read from** — never typed here. Resolved from the registry when this page renders, this service's tracks currently run on: **{{service_lane}}**. Provider and model reach a droid through its track, so a lane move cannot leave this page behind: the estate moved four times between August and September and this sentence used to name a vendor retired on 2026-08-06. Ninad ruled on 2026-09-11 (cookbook 1681) that no standing rule binds a track to a subscription or a model — the lane follows the requirement and the balance available on each subscription.
- **Git** holds the code under change; the close gates diff against the start commit.
- The **registry** and the **design store** are the binding sources of truth the pipeline reads from; the **pipeline core is root-owned (OS-locked)** and changes only through Radagast's core-install lane.

📖Design principles

- **Single source of truth.** Counts and narratives come from the live registry and design store, never hand-copied — the shared principle described on the [Carolverse Architecture](https://carolopedia.denken-labs.com/wiki/architecture) page.
- **Single-writer mutation.** Status changes go only through the status-router; the database is written through one relay.
- **Recommend, don't edit.** Watchers detect and healers recommend, but pipeline repairs are Orion's alone (self-heal suspended by ruling); the OS lock enforces it at the kernel.
- **One lane = one track = one budget lane.** Spend, work and accountability line up; refuse-before-spend, park-not-fail on budget, hard caps on retries.
- **Agent-centric modular architecture.** Every block has an accountable agent and a doing droid (Design #146).
- **Bypass skips the planner, not the standards** — same template checklist, review and observability as an autonomous run.
- **Observability first.** If it is not on a monitor with a deterministic state, it is not done.

📖Success criteria

- An initiative flows from file to close **without manual nudging** in the common case.
- **No false blocks** — reviewing / awaiting-UAT is never escalated by the stuck-watchdog; parked work is untouchable by watchdogs.
- **Incidents are fast** — critical breakages file in well under a second and surface at top priority.
- Every closed change carries a **twin-review verdict** and passes the **design/architecture** and **caller-audit** gates.
- **Monitor cards always match reality** — status and state move together, atomically; the pipeline shows one of its five honest states (running / paused / stalled / off, with the RSI-or-sprint mode).
- **No lock storms and no silent loss** of run-audit history.
- **Budgets hold** — no lane spends past its daily cap; a budget snag parks and resumes, it never destroys work.
- **Failures are diagnosed and escalated honestly** — the RSI line diagnoses blocked work and recommends; what it cannot cure lands abandoned in the Escalation Queue for the operator, never in an endless retry loop.

📖Policies

These are the rules the build pipeline is bound by, drawn from the Carol policies and the build cookbook:

📖What it delivers today

- **File a build initiative** with decisions, requirements, success criteria, strategy, plan steps and budget — enabled by Elrond, via his *Initiative Creator*, *Requirements Author* and *Filing Gate*.
- **Three build lanes** — autonomous (planner): Merlin orchestrates (his *Sequencer*), the team builds under evidence gates (Sage → Archon → Forge → Argus, privileged steps via Radagast); operator (bypass): Orion drives it; and the **Albus Bypass**: Albus completes abandoned, urgent and wish work on his own track's lane.
- **Sprint-based backlog, daily sprint plan, rolling dispatch queue and defer** — Elrond, via his *Sprint Builder*, *Daily Planner* and *Dispatcher*.
- **A monitor dashboard** with deterministic Current / Recent / Escalation / Dispatch cards — Elrond, via his *Foreman* and the status-router, with Hermione's monitors feeding it.
- **A per-initiative Palantir story wall** — Elrond, via his *Reporter*, which auto-composes the story at close.
- **Twin review, design/architecture and caller-audit gates, and UAT** — Themis checks compliance (her *Design* and *Architecture Compliance* droids), Argus verifies (his *Verifier*), Elrond's *Step Reviewer* and *Initiative Review* grade the work, and Orion's *Twin Reviewer* cross-checks.
- **Self-healing skills and a sub-second incident fast-path** — Sage builds and heals the skills, and Elrond prioritises incidents.
- **A daily process sweep** that files a fix when a scheduled job fails — Hermione's Process Monitoring detects and files it, and Elrond's pipeline fixes it.
- **What Initiatives receives from a migration (design 587, cookbook 1476)** — H3: the user-approved roadmap as filed initiatives, requester = the project contact, owner = requester; Elrond files, Leo requests.

📖What it will deliver

- A weekly sprint review that files self-improvement initiatives for the planner.
- Editor surfaces for defer and mode-change (today these are endpoints only).
- Relay hardening for blob columns and a full single-writer relay for the planner database.
- Cached policy briefs to cut filing-security-gate latency.
- Re-arming the suspended self-heal lane once the recommendations-only era proves out.