clearotron 0.2.2 → 0.2.4

package/driver/plain-register.mjs

@@ -0,0 +1,134 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// THE TWO-REGISTER RULE, AS THE REVIEWER READS IT — tracker issue 333.
+//
+// The report goes to a lawyer who layers advice on top, and that lawyer's client reads the same page.
+// The band, the summary, the basis line and the one-liners are the whole product for the second reader,
+// and they were the hardest lines on it: single sentences of seventy-odd words in the lawyer's
+// vocabulary. The owner's ruling is that default-visible text carries no legal or engine vocabulary at
+// all, and that inside a fold the lawyer's words are allowed where a plain one would lose precision.
+//
+// THIS IS ADVISORY AND MUST STAY ADVISORY. A hit is a rewrite of that line — never a disclosure to the
+// client, never a run failure. The rule is presentation: it changes no band, no evidence and nothing
+// that is searched.
+//
+// — AND IT MUST NOT FIRE ON THE MARK IT IS CLEARING.
+//
+// This is the defect `coverage-form.mjs` records one level in: a refusal that cannot tell a mark from
+// engine vocabulary blocked a clearance on the mark SLICE, and a render-time substitution turned "AXIS
+// Bank filed in class 36" into "group Bank filed in class 36" on a report clearing AXIS. Half the words
+// here are ordinary English and several are plausible marks — PREVAIL, SENIOR, SPECIFICATION. A check
+// that flagged the mark under clearance would put noise on exactly the report that matters most, so
+// every term the run is about is excluded before the text is read.
+
+/**
+ * The lawyer's vocabulary, as WORKED EXAMPLES with the plain form beside each. Not a ban list: the
+ * issue rejects "a list of forbidden words as the mechanism" in terms, and this is what the reviewer
+ * offers a seat as the rewrite, which is a different thing from a gate that refuses.
+ *
+ * Each entry is [what a lawyer writes, what the reader needs]. The second half is the load-bearing one —
+ * a flag naming a word teaches nothing, and the seat has to produce a sentence.
+ */
+export const PLAIN_FORMS = Object.freeze([
+  ["proprietor", "owner"],
+  ["subsisting", "live"],
+  ["specification", "goods list"],
+  ["citable", "earlier marks the office can raise against you"],
+  ["prevail", "win"],
+  ["formative", "names built on"],
+  ["belt-and-braces", "extra"],
+  ["non-use attack", "could be cancelled for not being used"],
+  ["on the record as it stands", "on what we found"],
+  ["marks-and-goods comparison", "same name, same goods"],
+  ["dispatch", "the request"],
+  ["instructed", "what was asked"],
+  ["chunk", ""],
+]);
+
+/** The longest visible sentence a reader should meet. The issue's number, not a derived one. */
+export const SENTENCE_WORD_LIMIT = 25;
+
+/**
+ * How a term in `PLAIN_FORMS` is looked for in prose — ONE definition, because two of them drift.
+ *
+ * THE INFLECTIONS ARE THE POINT, and they were the reason a second copy of this rule survived. The
+ * pre-delivery lint carried its own hand-tuned patterns — `\bproprietors?\b`, `\bprevails?\b|\bprevailing\b`
+ * — while this file built `\bproprietor\b` and matched neither plural. So the pinned source was the
+ * WEAKER of the two, and reading terms from it without this would have quietly narrowed what the live
+ * check catches: a consolidation that loses coverage is a regression wearing a tidy-up's clothes.
+ *
+ * A trailing `s`, `es`, `ed` or `ing` after the term, and a hyphen matching a space, which is how the
+ * same phrase is written in two documents by two people.
+ */
+export const termMatcher = (term) => new RegExp(
+  `\\b${term.replace(/[-]/g, "[- ]").replace(/\s+/g, "\\s+")}(?:e?s|ed|ing)?\\b`, "i");
+
+/** Everything the run is ABOUT — the mark, its variants, the owners named. Never flagged. */
+const ownTerms = (about = {}) => {
+  const out = [];
+  for (const v of [about.mark, ...(about.marks ?? []), ...(about.owners ?? []), ...(about.terms ?? [])]) {
+    const s = String(v ?? "").trim();
+    if (s) out.push(s.toLowerCase());
+  }
+  return out;
+};
+
+/** Sentences, split on terminators that end one. Crude on purpose — this counts words, not grammar. */
+export const sentencesOf = (text) =>
+  String(text ?? "").split(/(?<=[.!?])\s+/).map((s) => s.trim()).filter(Boolean);
+
+export const wordsIn = (sentence) => String(sentence ?? "").trim().split(/\s+/).filter(Boolean).length;
+
+/**
+ * What is wrong with one default-visible line, as rewrite advice. `[]` means nothing to say.
+ *
+ * `about` carries the run's own marks and owners so they are never reported — see the header. A term
+ * that IS the thing being cleared is not the lawyer's vocabulary, it is the subject.
+ */
+export function plainRegisterFlags(text, about = {}) {
+  const raw = String(text ?? "");
+  if (!raw.trim()) return [];
+  const mine = ownTerms(about);
+  // Blank the run's own terms before reading, rather than filtering hits afterwards: a mark can contain
+  // one of these words ("PREVAIL"), and a hit inside it is not a hit at all.
+  let scan = raw;
+  for (const t of mine) {
+    if (!t) continue;
+    scan = scan.replace(new RegExp(t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi"), " ");
+  }
+
+  const flags = [];
+  for (const [term, plain] of PLAIN_FORMS) {
+    if (!termMatcher(term).test(scan)) continue;
+    flags.push({
+      kind: "vocabulary",
+      term,
+      say: plain
+        ? `"${term}" is the lawyer's word — the reader needs "${plain}". Rewrite the sentence, do not swap the word.`
+        : `"${term}" is an engine word and has no place on a page a client reads. Rewrite the sentence.`,
+    });
+  }
+
+  for (const s of sentencesOf(raw)) {
+    const n = wordsIn(s);
+    if (n > SENTENCE_WORD_LIMIT) {
+      flags.push({
+        kind: "length",
+        words: n,
+        say: `${n} words in one sentence, and a visible line takes ${SENTENCE_WORD_LIMIT}. Split it — one idea per sentence, `
+          + "the conclusion first. Do not shorten it by dropping the reason.",
+      });
+    }
+  }
+  return flags;
+}
+
+/**
+ * The fields a reader meets before opening anything. Named here rather than at each call site so the
+ * two products answer to one list — the knockout and the clearance drifted apart once already.
+ */
+export const DEFAULT_VISIBLE_FIELDS = Object.freeze({
+  knockout: ["summary", "batchOpener", "basis", "net", "factors", "counterFactors", "mitigation", "standardCaveats", "reviewerNotes"],
+  clearance: ["summary", "oneLiner", "registrability", "thirdPartyRights", "ownRights", "freedomToOperate", "reviewerNotes", "coverage"],
+});

package/driver/portal-access.mjs

@@ -17,7 +17,7 @@ const domainOf = (email) => { const e = String(email ?? "").toLowerCase(); const
 /**
  * makePrincipal({ email, grants, staffDomains }) →
  *   { role: "staff",  email, accounts: "*" }            — firm identity: everything, acting-for allowed
- * | { role: "client", email, accounts: ["aurora", …] }  — enrolled client: exactly the granted accounts
+ * | { role: "client", email, accounts: ["foxglade", …] }  — enrolled client: exactly the granted accounts
  * | null                                                — unknown identity: no portal (the door 403s)
  * Staff wins over an (accidental) grants row; a client row with a tenant-wide "*" grant is honored
  * but the role stays client (no staff surfaces).

package/driver/portal-config-view.mjs

@@ -49,6 +49,11 @@ import { readFlagSnapshot, engineFor, providersFor, postureDisagreement } from "
 // reading is, because the question it was standing in for — does this still describe the box — now has
 // a direct answer in `lastRun.disagrees`.
 import { engineMode } from "./config-inventory.mjs";   // — the mode is DERIVED at read time, never stored
+// THE ENGINE TABLE, READ FOR TWO WORDS. A row saying an engine cannot run has to name the program it
+// could not find and the command that installs it, or the reader is told they have a problem and not
+// what to do about it — and this table is already where the wizard and the run-door preflight read
+// both of those, so naming them here adds no second description of an engine.
+import { ENGINE_BINARIES } from "./driver.config.mjs";
 
 /**
  * The flag view.
@@ -60,6 +65,30 @@ import { engineMode } from "./config-inventory.mjs";   // — the mode is DERIVE
 // One projection, used for whichever posture is the answer. Extracted when the live posture became that
 // answer, so the LIVE reading and the LAST-RUN capture cannot be shaped differently and quietly invite a
 // reader to compare two things that were built by two rules.
+/**
+ * The engine block, plus the two words a reader needs when it cannot run.
+ *
+ * DERIVED FROM THE ID AT READ TIME, never stored in the capture. A capture written by an older build
+ * carries neither field, and a page that read them out of the capture would go quiet about the engine
+ * on exactly the deployments most likely to be misconfigured. The id is in every capture there has
+ * ever been, and the table is in this build.
+ *
+ * NULL FOR AN ENGINE THIS BUILD DOES NOT SHIP, which the row already has its own sentence for. Naming
+ * a program for an engine that does not exist here would be an invented fact.
+ */
+function withProgram(engine) {
+  if (!engine) return engine;
+  const spec = ENGINE_BINARIES[engine.id] ?? null;
+  return {
+    ...engine,
+    // A BARE NAME, NEVER A RESOLVED PATH. `fallback` is what the table calls the program when nothing
+    // overrides it — "claude" — and it is what a reader types. The resolved path is this machine's
+    // layout and is deliberately kept out of anything a browser renders.
+    program: spec?.fallback ?? null,
+    install: spec?.install ?? null,
+  };
+}
+
 function postureView(snap) {
   return {
     flags: Object.entries(snap.flags ?? {}).map(([name, f]) => ({
@@ -72,7 +101,7 @@ function postureView(snap) {
       killSwitch: (snap.killSwitches ?? []).includes(name),
     })),
     built: snap.built ?? null,
-    engine: engineFor(snap),
+    engine: withProgram(engineFor(snap)),
     engineMode: engineFor(snap) ? engineMode(engineFor(snap)) : null,
     providers: providersFor(snap),
   };
@@ -239,6 +268,41 @@ export function authView({ mode = "", oidcIssuer = "", team = "", jwksUrl = "",
   };
 }
 
+/**
+ * Where the staff-domain rule was written, so a reader can go and undo it.
+ *
+ * ── WHY A PAGE THAT NAMES A RULE MUST ALSO NAME ITS ADDRESS ─────────────────────────────────────────
+ *
+ * The People & access screen renders the rule — "Anyone at <domain> — a rule, not a person" — and said
+ * nothing about where it came from. A reader who does not recognise the domain therefore learns that
+ * strangers may hold an administrator's view of their instance and has no next step at all: the value
+ * is in an environment variable, in one of two files depending on how the instance is run, and neither
+ * is named anywhere on the screen. The one outside reader who met this reported it as a back door,
+ * twice, which is the correct thing to do with an access rule you cannot trace.
+ *
+ * PURE, and it answers "could not tell" as itself. `envLoad` is `shared/env-local.mjs`'s own report of
+ * what this process read, so the answer describes the process actually serving the page rather than
+ * being composed from a path that some other process would have read — the distinction that module
+ * exists for. A service started by systemd took its configuration from an EnvironmentFile; a child of
+ * `clearotron start` was handed an explicit environment and read no file at all; a hand-run CLI read
+ * the CLI's file. Each gets its own sentence, because the remedy is a different file in each.
+ */
+export function staffRuleSource({ name = "PORTAL_STAFF_DOMAINS", value = "", envLoad = null,
+                                  unitEnvFile = null, cliEnvFile = null } = {}) {
+  if (!String(value ?? "").trim()) return null;
+  const reason = envLoad?.reason ?? null;
+  const applied = Array.isArray(envLoad?.applied) ? envLoad.applied : [];
+  if (reason === "read" && applied.includes(name))
+    return { name, where: `read from ${envLoad.path}` };
+  if (reason === "service-managed")
+    return { name, where: unitEnvFile ? `set in this service's environment file, ${unitEnvFile}` : "set in this service's environment" };
+  if (reason === "opted-out")
+    return { name, where: cliEnvFile
+      ? `handed to this service by the command that started it, which takes it from ${cliEnvFile} or derives it from the sign-in address`
+      : "handed to this service by the command that started it" };
+  return { name, where: cliEnvFile ? `set in this service's environment (the file it would otherwise read is ${cliEnvFile})` : "set in this service's environment" };
+}
+
 /**
  * The enrolment view: who is granted what, and where an enrolment is half done.
  *
@@ -246,7 +310,7 @@ export function authView({ mode = "", oidcIssuer = "", team = "", jwksUrl = "",
  * they are reported separately — a staff member absent from the grants file is normal, not a fault,
  * and listing them as "unenrolled" would bury the real problems.
  */
-export function accessView({ grants, staffDomains = [], knownAccounts = [], grantsFile = null }) {
+export function accessView({ grants, staffDomains = [], knownAccounts = [], grantsFile = null, staffRule = null }) {
   const tenants = grants?.tenants ?? {};
   const known = new Set(knownAccounts);
   const people = [];
@@ -277,6 +341,10 @@ export function accessView({ grants, staffDomains = [], knownAccounts = [], gran
   return {
     people: people.sort((a, b) => a.email.localeCompare(b.email)),
     staffDomains: [...staffDomains],
+    // An ADDITIONAL field rather than a reshape of `staffDomains`: that array is parsed by the browser
+    // contract and read by three screens' worth of arms, and a rule nobody can trace is a copy problem,
+    // not a data-shape problem. Null when there is no rule, or when the source could not be told.
+    staffRule,
     // Accounts named in grants that no profile matches — the other typo direction.
     unknownAccounts: [...unknownAccounts].sort(),
     // Where to go to change any of this — a filename and a date, so "I want to add someone" has a

package/driver/portal-families.mjs

@@ -18,7 +18,7 @@
 // ── the shape ────────────────────────────────────────────────────────────────────────────────────────
 //
 //   { "schema": 1,
-//     "families": { "hydra-range": { "name": "Hydra range", "account": "aurora" } },
+//     "families": { "hydra-range": { "name": "Hydra range", "account": "foxglade" } },
 //     "of":       { "<runId>": "hydra-range" } }
 //
 // Keyed by RUN rather than by mark. A mark is not a thing the pool stores — it is a grouping the browser

package/driver/portal-local-auth.mjs

@@ -47,6 +47,7 @@ import { randomBytes, scryptSync, timingSafeEqual, createHmac } from "node:crypt
 import { readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
+import { envPrefix } from "../shared/os-advice.mjs";
 
 // ── the credential record ────────────────────────────────────────────────────────────────────────
 //
@@ -164,7 +165,10 @@ export function passphraseResetCommand({ prefix = "", credentialPath = null, env
   const base = `${prefix}clearotron passphrase --reset`;
   const path = credentialPath ?? env.PORTAL_LOCAL_CREDENTIAL ?? null;
   if (!path || path === credentialPathFor({}, home)) return base;
-  return `PORTAL_LOCAL_CREDENTIAL=${path} ${base}`;
+  // `VAR=value cmd` IS POSIX-ONLY. PowerShell has no such juxtaposition — the assignment is its own
+  // statement there — so this line told a Windows reader their variable name was not a cmdlet, naming
+  // the wrong half of the command as the fault. Reported from a real run.
+  return `${envPrefix("PORTAL_LOCAL_CREDENTIAL", path)}${base}`;
 }
 
 /**

package/driver/portal-report.mjs

@@ -21,7 +21,7 @@ import { SUMMARY_BLOCK_LINE } from "../shared/summary-blocks.mjs";
 // a brand lockup, links to the pool index, status, profiles, and a "Clients" dropdown listing
 // EVERY customer by key:
 //
-//     <a href="../customer/zephyr/">…  <a href="../customer/aurora/">…
+//     <a href="../customer/coastline/">…  <a href="../customer/foxglade/">…
 //
 // That is correct for a file a lawyer opens from the archive, and it is a disclosure of the client list
 // to anybody else. It has to come out before the document is embedded, and not because the nav is ugly:

package/driver/portal-service.mjs

@@ -38,7 +38,7 @@ import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
 import { storeInRepo, storeOutsideRepoMessage, makeCommittableAudit, resolveStoreRepoRoot, makeStoreCommit } from "../shared/store-in-repo.mjs";   //,
 import { customerStoreDir, customerStoreLine } from "../shared/customer-store.mjs";   // — one store for the surface and the runs
 import { clientFailureNote } from "../shared/client-failure-note.mjs";   // — one sentence, three surfaces
-import { bareInvocation, invocationPrefix } from "../shared/invocation.mjs";   // — and why this one surface is by NAME
+import { bareInvocation, invocationPrefix, installRoute } from "../shared/invocation.mjs";   // — and why this one surface is by NAME
 import { stdioConnectOffer, stdioConnectFor, STDIO_SHAPES } from "../shared/stdio-connect.mjs";   // — ONE author for the connect route
 import { connectOffers, offersForWire } from "../shared/connect-clients.mjs";                 // — ONE table, resolved server-side
 // — the portal became an ISSUANCE PATH here, deliberately and by owner ruling.
@@ -92,7 +92,7 @@ import { readFlagSnapshot, builtFor, registerCanCountFor, registerTerritoriesFor
 import { isDemo, demoPostureLine } from "./demo-posture.mjs";   
 import { triggerCapGap, triggerCapWarning } from "./trigger-cap.mjs";   // F51 — one answer, three surfaces
 import { makeUpstream } from "./portal-upstream.mjs";
-import { flagView, accessView, observedView, authView } from "./portal-config-view.mjs";
+import { flagView, accessView, observedView, authView, staffRuleSource } from "./portal-config-view.mjs";
 import { livePosture } from "./flag-snapshot.mjs";   // — for the capture-vs-box comparison only, never for a value
 import { familiesView, groupRuns, ungroupRuns } from "./portal-families.mjs";
 import { validateJob } from "./enqueue-schema.mjs";
@@ -1029,6 +1029,11 @@ function outcomeRow({ event = "request-refused", method, path, email = null, sta
 export function makePortalService({
   poolRoot, workspaceRoot, recipesDir = undefined, secret,
   staffDomains = [], grants = null,
+  // Where the staff-domain rule is written, for the People & access page to name. INJECTED, because
+  // the answer is a fact about the PROCESS — which file, if any, it took its configuration from — and
+  // this constructor is deliberately pure over its inputs. Null means "no rule, or could not tell",
+  // and the page then says nothing rather than guessing at a path.
+  staffRule = null,
   // The queue directories the RUNNER drains — the same list it hands checkRunCaps. The allowance counter
   // and the quota pre-check read their ledger beside these, so they count what the wall counts (:
   // they used to reconstruct a workspace-relative path that resolved to nothing once the queue moved out
@@ -1328,6 +1333,48 @@ export function makePortalService({
   };
   const selectorOf = (body) => (body.recipeKey ? `recipe:${body.recipeKey}` : `product:${body.product || "the account's default"}`);
 
+  // ── The engine program, read once, for every surface that reports it ───────────────────────────
+  //
+  // WHY /me NEEDS THIS AT ALL. The settings page can ask `/portal/admin/config`, which already computes
+  // the live-versus-capture comparison. New clearance cannot: that route is staff-only, and the reader
+  // who gets stuck here is as often a client. A screen that asked it would get a 404 and fall back to
+  // the generic advice — which is the exact defect this exists to end, delivered to the exact reader
+  // who reported it.
+  //
+  // WHAT IT COSTS ON A NORMAL PAGE VIEW: NOTHING, and that is structural rather than a promise. The
+  // question only has a wrong answer in one state — the capture says there is no engine program — so
+  // the live reading is taken only in that state. An install with a working engine never reaches the
+  // probe, and /me is the hottest endpoint in the portal.
+  //
+  // AND IT IS THE SAME MECHANISM THE SETTINGS PAGE USES, deliberately: `flagView` with a live posture,
+  // and the same `engine program` row out of `lastRun.disagrees`. Two surfaces answering this question
+  // by two routes is how they came to contradict each other in the first place.
+  //
+  // NOT CACHED, AND THAT IS THE POINT OF THE CHANGE. A held reading was written first and removed: it
+  // would have meant a reader who restarted the engine service went on being told to restart it for
+  // as long as the window lasted — the staleness this whole change exists to end, in miniature, in
+  // the one place a reader is standing when they act on it. Measured in testing, 2026-09-08: 0.28ms
+  // for a reading taken cold with the imports warm, and a 0.29ms median over 50 requests in the state
+  // that takes one on every request, against 0.04ms in the state that takes none. It is taken only
+  // where a search is already refusing, so there is nothing here worth trading a wrong answer for.
+  async function engineProgramDisputed(mode) {
+    // NOT DEMO, NOTHING TO DISPUTE. The capture already sees the program, so the only disagreement
+    // left is the mirror — this box cannot see what the engine could — and that one does not change
+    // what this screen says: the screen is not refusing a search in that state.
+    if (mode !== "demo") return false;
+    try {
+      const live = await livePosture();
+      // `disagrees` is [] on agreement, rows on disagreement, and null when there is no capture to
+      // compare against — three facts, and only the middle one is this. A null must not read as false.
+      const rows = flagView(poolRoot, { live }).lastRun?.disagrees;
+      return Array.isArray(rows) ? rows.some((d) => d.what === "engine program") : null;
+    } catch {
+      // COULD NOT LOOK, AND IT SAYS SO. Null travels to the screen as "unknown" and the screen prints
+      // the general advice, which is what it printed before this existed.
+      return null;
+    }
+  }
+
   async function route(method, path, identity, body = {}, query = {}) {
     const principal = makePrincipal({ email: identity?.email, grants: grantsNow(), staffDomains });
     const parts = path.replace(/\/+$/, "").split("/").filter(Boolean);   // ["portal", ...]
@@ -1338,7 +1385,7 @@ export function makePortalService({
         assertPrincipal(principal, { door: true });   // door check only — a multi-account client enters and gets the picker list
         // `accountNames` — the DISPLAY name of each account this identity holds, and nothing else.
         //
-        // Every profile carries a name ("Vantor Labs", "Aurora Interactive"); the account KEY is a
+        // Every profile carries a name ("Vantor Labs", "Foxglade Interactive"); the account KEY is a
         // slug ("vantor"). Staff read names because the account picker fetches the staff-only
         // roster; a client had no name source at all, so the identical screen printed the slug at them.
         // The same brand owner therefore read two different ways depending on who signed in, which is
@@ -1384,8 +1431,23 @@ export function makePortalService({
         // writes at boot and derives the mode from `binaryPresent`, which that snapshot already
         // carries. NULL when there is no snapshot to read, and null means THIS CANNOT ANSWER — the UI
         // must leave the button alone rather than infer demo from an absent file.
+        // READ ONCE. The payload names it and the program reading below is gated on it; two calls to
+        // `flagView` here would be two reads of the same file that could disagree with each other.
+        const meEngineMode = flagView(poolRoot).engineMode;
         return { status: 200, json: { role: principal.role, email: principal.email, accounts: principal.accounts, accountNames,
-          concurrentRuns: concurrentRunsCap(), brand: BRAND.name, engineMode: flagView(poolRoot).engineMode,
+          concurrentRuns: concurrentRunsCap(), brand: BRAND.name, engineMode: meEngineMode,
+          // WHETHER THE PROGRAM IS ON THIS BOX WHILE THE ENGINE CANNOT SEE IT — true, false, or null
+          // for "this could not be checked". The screen above renders one of three remedies from it,
+          // and they are different remedies: install the CLI, restart the service that cannot see it,
+          // or the general advice when nothing could be read. Only `engineMode: "demo"` can make this
+          // anything but false; see `engineProgramDisputed`.
+          engineProgramDisputed: await engineProgramDisputed(meEngineMode),
+          // HOW THIS INSTALL ARRIVED, so a screen can name the setup command the reader can actually
+          // type. `npm run setup` and `npx clearotron install` are the same wizard and each one is
+          // unrunnable on the other route; the no-engine notice named one of them and was wrong for
+          // half its readers. A WORD, never a command line and never a prefix: `invocationForm` can
+          // answer with this machine's absolute path, and this value is rendered in a browser.
+          setupRoute: installRoute(),
           // — a button that always fails must not render as available. The reason is
           // operator-shaped and staff-only; a client reads the generic sentence the button carries.
           controls: { stop: { available: stopControl.available !== false,
@@ -2131,7 +2193,7 @@ export function makePortalService({
         // command is a true fact about THIS INSTALL'S OWN DISK, useful to anyone with a shell on the
         // box and useless to a hosted client who has no checkout. On a local install the reader IS the
         // operator, which is why the split that already exists does the work an "is this deployment
-        // local" inference would have done badly. Agreed with overwatch before building, because it
+        // local" inference would have done badly. Agreed before building, because it
         // changes what a signed-in staff user is shown.
         //
         // COMPOSED IN ONE PLACE and handed over as a string. The browser cannot know this install's
@@ -2822,7 +2884,7 @@ export function makePortalService({
             const p = envFrom(process.env, "CLEAROTRON_ACCESS_FILE");
             if (p) grantsFile = { name: basename(p), modifiedAt: new Date(statSync(p).mtimeMs).toISOString() };
           } catch { /* reported as unknown; a failed stat must not take down the page that explains access */ }
-          return { status: 200, json: accessView({ grants: grantsNow(), staffDomains, knownAccounts, grantsFile }) };
+          return { status: 200, json: accessView({ grants: grantsNow(), staffDomains, knownAccounts, grantsFile, staffRule }) };
         }
         // /portal/admin/observed — who has actually USED this instance lately, from the audit log.
         //
@@ -3506,7 +3568,7 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
       // local-auth block, so calling it from here threw ReferenceError and this route answered 500 —
       // worse than the dead link it replaced, because a dead link looks like a dead link and a 500
       // looks like the server broke. Found by `npm run lint:driver`, which says it in one line
-      // (`'redirect' is not defined`), and by role-dev/Grogu driving the route rather than reading it.
+      // (`'redirect' is not defined`), and by driving the route rather than reading it (review, 2026-08).
       // Hoisting that helper would move it away from the comment explaining its own no-`?next=` rule,
       // so the four lines live here instead.
       if (!localAuth && url.pathname === "/portal/sign-out") {
@@ -3915,6 +3977,14 @@ const PORT = PORT_CHOICE.port;
   const grants = () => loadGrants({});
   const staffDomains = (process.env.PORTAL_STAFF_DOMAINS || "").split(",").map((s) => s.trim()).filter(Boolean);
   if (!staffDomains.length && !grants()) { log(`FATAL: neither PORTAL_STAFF_DOMAINS nor CLEAROTRON_ACCESS_FILE configured — nobody could ever sign in (fail-closed).`); process.exit(1); }
+  // WHERE THAT RULE IS WRITTEN, resolved once at boot and handed to the service. `loaded` is this
+  // process's own report of which file configured it — never a path composed here, which would answer
+  // for a process that read nothing (see `envFileRead`'s note in shared/env-local.mjs).
+  const { loaded, unitEnvPath, envLocalPath } = await import("../shared/env-local.mjs");
+  const staffRule = staffRuleSource({
+    value: process.env.PORTAL_STAFF_DOMAINS, envLoad: loaded,
+    unitEnvFile: unitEnvPath(), cliEnvFile: envLocalPath(),
+  });
 
   const { config } = await import("./driver.config.mjs");
   const { appendFileSync: append } = await import("node:fs");
@@ -4188,7 +4258,7 @@ const PORT = PORT_CHOICE.port;
       // The result was not a failure. It was worse. With the overlay unset, resolveSkillPath falls back
       // to the PRODUCT REPO's own driver/skills — where the customer frameworks either do not exist
       // (a config-store-only customer → the page's fail-loud "could not be read" card) or exist as the SYNTHETIC
-      // DEMO fixtures the sellable codebase ships (Aurora, Zephyr → "Aurora Interactive risk framework
+      // DEMO fixtures the repository carries for the suite (a framework titled "… risk framework
       // (synthetic demo)", source_deck "content invented"). The second case renders with a title, a band
       // ladder and band meanings, and is indistinguishable on screen from the client's real framework.
       // A lawyer read invented risk definitions as their client's own for as long as this was live.
@@ -4356,7 +4426,7 @@ const PORT = PORT_CHOICE.port;
   const service = makePortalService({ poolRoot: config.poolRoot, workspaceRoot: config.workspaceRoot,
     // Re-read per request (a getter that rescans), so a workspace created after boot is counted.
     queueDirs: () => config.queueDirs,
-    secret, staffDomains, grants, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
+    secret, staffDomains, staffRule, grants, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
     // — the ONLY place the environment is read for this. `bin/start.mjs` is the
     // only thing that sets it, and it sets it explicitly rather than passing the operator's inherited
     // environment through, so a stray `.env` can neither put a live install into demo mode nor take a

package/driver/portal-upstream.mjs

@@ -96,7 +96,7 @@ export const PATH_FIELDS = ["frameworkPath", "workedExamplesPath"];
 /**
  * The code-owned values, READ-ONLY, for display. The page shows them badged; it cannot send them.
  *
- * Two of them are PATHS INSIDE THE ENGINE — `skills/prelim-search/risk-framework-zephyr.md` — and they
+ * Two of them are PATHS INSIDE THE ENGINE — `skills/prelim-search/risk-framework-<customer>.md` — and they
  * are withheld from a client here, on the server, where the role is already in hand. The React page has
  * filtered them out of its own render since the rebuild, but a filter in the browser is a display
  * convenience and not a wall: the value still crossed the wire and was one devtools tab away.
@@ -129,7 +129,7 @@ export function readOnlyFields(profile, { staff = false } = {}) {
  *
  *   house    "…IP Risk Assessment Framework.pptx (Privileged & Confidential), transcribed 2026-07-05
  *             (doc 50); supersedes the client-transposed neutral default"
- *   aurora   "Synthetic demo transposition of a customer risk deck (structure faithful, content
+ *   demo     "Synthetic demo transposition of a customer risk deck (structure faithful, content
  *             invented), doc 50 shape"
  *   triage   "Ported from the interactive knockout-searches skill's 5-tier rating system (SKILL.md
  *             rating table + calibration rules), doc 50 shape"