📖About

INI-029's Session Induction app surfaced this: registry row stored url='http://carol-vm:7169' (an SSH-aliased hostname not resolvable from a browser) and a duplicate session_induction row exists at port 7168. App was registered with no public URL convention enforcement and no external-reachability check.

Fix the gap class across all pipeline stages so it doesn't repeat: - Archon authors a Design row codifying the URL pattern (https://carol.denken-labs.com/dev//) - Forge updates register_app.py to validate URL + reject private hosts + idempotent upsert by dir_name - Argus adds a task-test: registry.apps.url matches the pattern AND is reachable externally - Template-A gets decide + review rows referencing the Design (auto-picked up by Elrond's Reviewer template-loader) - Cleanup the duplicate session_induction registry rows

Themis is OUT of scope. URL-pattern is a design concern owned by Archon; validation is Forge's responsibility; testing is Argus's. Merlin's step-run review and Elrond's phase review pick up the new template rows automatically — no aggregator code changes.

⚖️Decisions

• URL pattern: https://carol.denken-labs.com/dev/<route>/ — public domain only; never localhost / 127.0.0.1 / carol-vm — Carol's public surface is via Cloudflare tunnel + nginx. Anything else is unreachable from a browser. (Ninad)
• Themis (compliance) has NO role in this pipeline contract — Per INI-185 spirit, compliance is post-build and isolated. URL pattern is design + validator territory. (Ninad)
• Owners: Archon (design row) + Forge (register_app.py validator) + Argus (task-test) + Merlin (step-run aggregates the new review row) + Elrond (Initiative Reviewer auto-loads new template row) — No new aggregator code — adding template rows with right phase/owner is enough. Existing INI-149 + INI-159 wire-up handles the rest. (Ninad)
• Cleanup the duplicate session_induction registry row (port 7168 vs 7169) — Idempotent upsert on dir_name canonical form prevents future dupes; existing dupe must be cleaned by hand once. (Ninad)
• requester rewritten ninad -> orion per CAROL-INI-744: orion is the only human-CLI requester — Backfill of historical rows after INI744 added API-level refusal of requester=ninad. Orion is Ninads CLI agent; all human-originated initiatives are filed with requester=orion. (orion)
• [status-router] closed -> blocked | event=operator_revert | Closed without implementation: all 6 criteria are process meta-checks (e.g. 'shipped via bypass'), zero verify the pipeline contract actually works. Steps marked completed but no code changes exist (register_app.py validator, unit-test new row, step-run aggregates — none built). Criteria must verify output, not process. (or-bx-01)
• RSI diagnosed: 2026-07-01 02:00:50 -> improvement #(none). ({'_raw': 'ROOT CAUSE: The pipeline contract was blocked because all six closure criteria listed in the [status-router] event were process meta-checks (e.g., "shipped via bypass") rather than substantive validations that the actual pipeline contract design, validator, or template rows function corre (el-rsi-eng-01)
• [status-router] blocked -> diagnosis | event=diagnosis_start | RSI loop: oldest blocked (since 2026-07-01 01:45:13); Albus diagnosis INI 999900488 (el-rsi-loop-01)
• Orion remediation in progress: INI-999900488 bypass opened — CAROL-INI-696: an Orion-driven bypass has been opened to remediate this parent. The canonical Orion remediated: marker will be posted on close — see cookbook 156 / 155. (shared.bypass.bypass_start)
• Albus RSI diagnosis (root cause): [procedural, confidence high] The initiative was blocked because the closure criteria were all process meta-checks (e.g., 'shipped via bypass') instead of substantive verifications that the pipeline contract actually works (validator code, testable rows, dedup effect). Although the steps were marked complete, no code changes or verifiable outputs were produced, so the operator reverted the close as a procedural gate failure. (albus)
• Albus RSI recommendations: - Rewrite the success criteria to measure concrete outputs (e.g., 'register_app.py rejects private hostname with error code X', 'checklist_templates contains a new Argus execute row referencing the design row ID', 'session_induction row count is exactly one with the correct URL'). - Ensure each criterion references a specific artifact or behavior that can be directly inspected or tested, not a process milestone. - After implementing code changes (validator, template rows, dedup), capture evidence for each criterion (e.g., test output, SQL query result, checklist row count) before closing. || Next attempt succeeds because: The next attempt will produce verifiable artifacts (code change, test results, dedup outcome) that match the redefined substantive criteria, satisfying the operator that real work was done. (albus)
• Orion remediated: INI-999900488 bypass closed — CAROL-INI-696 close-marker: the Orion bypass INI-999900488 filed against this parent reached terminal state (closed). This row's literal prefix Orion remediated: is the canonical signal the cookbook-155 dispatcher gate looks for. (shared.bypass.bypass_end)
• Orion remediated: Albus RSI diagnosis: [procedural, confidence high] The initiative was blocked because the closure criteria were all process meta-checks (e.g., 'shipped via bypass') instead of substantive verifications that the pipeline contract actually works (validator code, testable rows, dedup effect). Although the steps were marked complete, no code changes or verifiable outputs were produced, so the operator reverted the close as a procedural gate failure. (orion)
• Orion remediated: Albus RSI diagnosis: [procedural, confidence high] The initiative was blocked because the closure criteria were all process meta-checks (e.g., 'shipped via bypass') instead of substantive verifications that the pipeline contract actually works (validator code, testable rows, dedup effect). Although the steps were marked complete, no code changes or verifiable outputs were produced, so the operator reverted the close as a procedural gate failure. (orion)
• [status-router] diagnosis -> closed | event=operator_put | PUT /api/initiatives (operator)

✅Success criteria

• Design row exists (id captured) with public-URL pattern documented (must_have)
• register_app.py rejects a synthetic call with url='http://carol-vm:9999' + accepts a synthetic call with the canonical pattern (must_have)
• checklist_templates contains 1 new Argus execute row + 1 new Merlin review row for type_code='A' referencing the design row (must_have)
• Registry has exactly one session_induction row with the public URL (must_have)
• No Themis-* in any row added by this initiative (must_have)
• Initiative shipped via canonical bypass (must_have)