clearotron 0.2.4 → 0.3.0-beta.1

package/driver/portal-access.mjs

@@ -1,99 +1,166 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// portal-access.mjs — identity → principal for the unified portal. The INNER
-// authorization boundary: CF Access (the edge) proves WHO; this module decides WHAT THEY SEE. Pure
-// decisions over injected inputs (grants object + staff domains) — fail-closed at every edge:
-// an unmapped identity gets NO principal (403 at the door), a cross-account request resolves to 404
-// semantics (never 403 — existence must not leak), and the grants substrate is the SAME file shape
-// the MCP faces read (`CLEAROTRON_ACCESS_FILE`, shared/scope.mjs loadGrants), so portal enrolment and MCP
-// grants stay one roster. Shape and semantics: INSTALL.md §8; examples/grants.example.json.
-import { accountsForEmail } from "../shared/scope.mjs";
+// portal-access.mjs — identity → principal for the unified portal. The INNER authorization boundary:
+// the sign-in door proves WHO; this module decides WHAT THEY SEE AND MAY DO. Pure decisions over the
+// grants object — fail-closed at every edge: an unmapped identity gets NO principal (403 at the door), a
+// request outside the person's access resolves to 404 semantics (never 403 — existence must not leak),
+// and the grants substrate is the SAME file the connector reads (`CLEAROTRON_ACCESS_FILE`), resolved by
+// the SAME function (`resolvePerson`, shared/scope.mjs), so the two doors cannot disagree about a person.
+// Shape and semantics: INSTALL.md §8; examples/grants.example.json.
+import { resolvePerson } from "../shared/scope.mjs";
 
-// LAST-@ semantics, matching the CF edge verifier (cf-access.mjs) and isFirmDomain (shared/scope.mjs)
-// — the privilege parse must never disagree with the edge parse (review 2026-07-18: a first-@ split
-// classified "x@firm.ch@evil.com" as staff while the edge saw evil.com).
-const domainOf = (email) => { const e = String(email ?? "").toLowerCase(); const i = e.lastIndexOf("@"); return i < 0 ? "" : e.slice(i + 1); };
+/**
+ * makePrincipal({ email, grants }) → the person, or null when the address has no access anywhere.
+ *
+ *   { email, everything, permissions: { run, manage }, access, accounts, organisations, genericOrgs, accountOrgs }
+ *
+ * There is no role. What a person may SEE is their access; what they may DO is two switches, asked by
+ * name through `seesEverything`, `mayRun` and `mayManage` below and never through a role word. Nothing
+ * about the part of an address after its `@` admits anyone: the staff-by-domain branch is deleted, and an
+ * address is admitted by its own entry in the grants file.
+ *
+ * `generic` is never in `accounts`. It is not a company: each organisation has its own, it is addressed as
+ * the pair (`account=generic`, `tenant=<organisation>`), and `genericOrgOf` decides it.
+ */
+export function makePrincipal({ email, grants = null }) {
+  return resolvePerson(email, grants);
+}
+
+/** Access to the top of the tree: every organisation, every company, every person. */
+export const seesEverything = (p) => p?.everything === true;
+/** Run clearances: start and stop them, inside the person's access. */
+export const mayRun = (p) => p?.permissions?.run === true;
+/** Manage: add people, add companies, change settings, inside the person's access. */
+export const mayManage = (p) => p?.permissions?.manage === true;
+
+/** An organisation's display name: its `name` in the grants file, else its key. */
+export function organisationName(grants, key) {
+  const n = grants?.tenants?.[key]?.name;
+  return typeof n === "string" && n.trim() ? n.trim() : key;
+}
+
+/** An access point as the portal shows it: names attached, keys kept. `everything` carries no key. */
+export function namedPoint(p, grants, companyNames = {}) {
+  if (p.kind === "everything") return { kind: "everything" };
+  if (p.kind === "organisation") return { kind: "organisation", key: p.key, name: organisationName(grants, p.key) };
+  return { kind: "company", key: p.key, name: companyNames[p.key] ?? p.key, org: p.org };
+}
 
 /**
- * makePrincipal({ email, grants, staffDomains }) →
- *   { role: "staff",  email, accounts: "*" }            — firm identity: everything, acting-for allowed
- * | { role: "client", email, accounts: ["foxglade", …] }  — enrolled client: exactly the granted accounts
- * | null                                                — unknown identity: no portal (the door 403s)
- * Staff wins over an (accidental) grants row; a client row with a tenant-wide "*" grant is honored
- * but the role stays client (no staff surfaces).
+ * What `/portal/api/me` says about a person's reach and switches — the fields the screens read, so no
+ * screen derives a visibility rule of its own. `organisations` is every organisation the person sees
+ * anything in (a company's heading needs its organisation's name); `genericOrgs` is the ones whose
+ * Generic they see.
  */
-export function makePrincipal({ email, grants = null, staffDomains = [] }) {
-  const e = String(email ?? "").trim().toLowerCase();
-  if (!e || !e.includes("@")) return null;
-  if (e.indexOf("@") !== e.lastIndexOf("@")) return null;   // multi-@ identities are refused outright — no parse to disagree about
-  if (staffDomains.map((d) => String(d).toLowerCase()).includes(domainOf(e)))
-    return { role: "staff", email: e, accounts: "*" };
-  const accounts = accountsForEmail(e, grants);
-  if (accounts === "*") return { role: "client", email: e, accounts };
-  if (Array.isArray(accounts) && accounts.length) {
-    // `generic` is STAFF-ONLY and every route already enforces that (portal-service: the runs listing,
-    // the report route and the LEAK-#9 rule all 404 it for a client). What no route did was stop it
-    // being OFFERED: a tenant-wide grant expands to the full roster, `generic` is in the roster, and it
-    // sorts first — so the brand-owner picker showed it at the top, the sidebar named it as the
-    // client's own account, and choosing it produced "The list could not be loaded" every time.
-    //
-    // Found by resolving the real production grants for the one enrolled client rather than by reading
-    // the route code, which looked correct in isolation. The routes WERE correct; the roster handed to
-    // the picker was not, and a menu whose first item always fails is a defect wherever the refusal is
-    // implemented.
-    //
-    // Filtered here, at the point the identity is decided, so the picker, the sidebar and every route
-    // are working from one list. An explicit grant of `generic` is dropped too: it is not a thing a
-    // client may hold, so honouring it in the menu would only defer the same 404.
-    const visible = accounts.filter((a) => a !== "generic");
-    if (visible.length) return { role: "client", email: e, accounts: visible };
-    return null;   // a client granted nothing BUT generic holds no visible account at all
-  }
-  return null;
+export function principalView(principal, grants, companyNames = {}) {
+  return {
+    permissions: { run: mayRun(principal), manage: mayManage(principal) },
+    access: (principal.access ?? []).map((p) => namedPoint(p, grants, companyNames)),
+    organisations: (principal.organisations ?? []).map((key) => ({ key, name: organisationName(grants, key) })),
+    accountOrgs: { ...(principal.accountOrgs ?? {}) },
+    genericOrgs: [...(principal.genericOrgs ?? [])],
+  };
+}
+
+/**
+ * May this person read a run, given who it belongs to? The ONE answer for every run-scoped route: the
+ * listing, the report, the summary, the feedback form. `owner` is the run's company key (`generic` when it
+ * had none); `organisation` is the organisation a Generic run was filed under, null for one filed before
+ * organisations existed.
+ *
+ * A company's run: the company must be inside the person's access. A Generic run: the person must see
+ * that organisation's Generic — and an unfiled one is visible only to a person who sees everything, which
+ * is exactly who could read it before.
+ */
+export function mayReadRun(principal, { owner, organisation = null }) {
+  if (!principal) return false;
+  if (owner !== "generic") return principal.accounts === "*" || (Array.isArray(principal.accounts) && principal.accounts.includes(owner));
+  if (seesEverything(principal)) return true;
+  return organisation != null && Array.isArray(principal.genericOrgs) && principal.genericOrgs.includes(organisation);
+}
+
+/**
+ * Does everything `other` holds sit inside `viewer`'s reach? Switches belong to the person, not to an
+ * access point, so a manager may set someone's switches only when that person's whole access is inside
+ * the manager's own — otherwise changing them would change what the person may do somewhere the manager
+ * cannot see.
+ */
+export function reachCovers(viewer, other) {
+  if (seesEverything(viewer)) return true;
+  if (!other || seesEverything(other)) return false;
+  const orgs = viewer?.genericOrgs ?? [];
+  const companies = Array.isArray(viewer?.accounts) ? viewer.accounts : [];
+  return (other.access ?? []).every((p) => p.kind === "organisation" ? orgs.includes(p.key)
+    : p.kind === "company" ? orgs.includes(p.org) || companies.includes(p.key) : false);
 }
 
 export class PortalDeny extends Error {
   constructor(status, message) { super(message); this.name = "PortalDeny"; this.status = status; }
 }
 
+/**
+ * Which organisation's Generic a request means — the organisation key, or null.
+ *
+ *   named       it must be one whose Generic this person sees (`genericOrgs`), else 404;
+ *   unnamed     the one organisation whose Generic they see, when there is exactly one;
+ *   unnamed, for a person who sees everything and several organisations (or none): null — Generic filed
+ *               under no organisation, which is how every Generic run was filed before organisations
+ *               existed, and only a person who sees everything sees those runs;
+ *   otherwise   404 when they see no Generic at all, 400 naming the field when they see several.
+ */
+export function genericOrgOf(principal, tenant = null) {
+  const t = tenant == null || String(tenant).trim() === "" ? null : String(tenant).trim();
+  const orgs = Array.isArray(principal?.genericOrgs) ? principal.genericOrgs : [];
+  if (t != null) {
+    if (orgs.includes(t)) return t;
+    throw new PortalDeny(404, "not found");
+  }
+  if (orgs.length === 1) return orgs[0];
+  if (seesEverything(principal)) return null;
+  if (!orgs.length) throw new PortalDeny(404, "not found");
+  throw new PortalDeny(400, "name an organisation (?tenant=) — Generic belongs to an organisation, and this login sees several");
+}
+
 /**
  * The ONE chokepoint every account-scoped route passes. Resolves the EFFECTIVE account for a request:
- *   - staff: any account (the acting-for picker) — but an account must still be NAMED for
- *     account-scoped routes (no accidental firm-wide writes);
- *   - client: the named account must be inside the grant — a foreign account is a 404 (not 403:
- *     existence never leaks), an unnamed account defaults to their only account (convenience) or
- *     404s when ambiguous.
- * staffOnly routes 404 for clients (the surface does not exist for them).
+ *   - a person who sees everything: any account — but an account-scoped route must still NAME one (no
+ *     accidental install-wide writes); unnamed resolves to null and the caller decides (list-all views);
+ *   - anyone else: the named account must be inside their access — a foreign account is a 404, never a
+ *     403, because existence never leaks; unnamed defaults to their only company, or is a 400 when there
+ *     are several or none;
+ *   - `generic` is the pair, and `genericOrgOf` decides it here rather than per route.
+ *
+ * The gates — `everything` for install-wide surfaces, `manage`, `run` — each refuse with 404: the surface
+ * does not exist for this person, and a refusal that told "you may not" apart from "there is nothing
+ * here" would tell a stranger which endpoints exist.
+ *
+ * ORDERING GENERIC follows the rule for seeing it: a person who holds the organisation whole, and holds
+ * Run. Spending against it is bounded as a company's is — every organisation's Generic lane carries the
+ * daily cap (ruling 2026-09-10), counted by the runner in the lane of the organisation the job is
+ * filed under, which `genericOrgOf` has just decided.
  */
-export function assertPrincipal(principal, { staffOnly = false, account = null, door = false } = {}) {
+export function assertPrincipal(principal, { account = null, tenant = null, door = false,
+  everything = false, manage = false, run = false, ...rest } = {}) {
+  if ("staffOnly" in rest) throw new TypeError("assertPrincipal: `staffOnly` is gone — gate on `everything`, `manage` or `run`");
   if (!principal) throw new PortalDeny(403, "no portal access for this identity");
-  if (staffOnly && principal.role !== "staff") throw new PortalDeny(404, "not found");
+  if (everything && !seesEverything(principal)) throw new PortalDeny(404, "not found");
+  if (manage && !mayManage(principal)) throw new PortalDeny(404, "not found");
+  if (run && !mayRun(principal)) throw new PortalDeny(404, "not found");
   // door mode: the caller only needs "may this identity enter" — NEVER resolve an account (a
-  // multi-account client must not 404 off the front door; review 2026-07-18)
+  // multi-account person must not 404 off the front door; review 2026-07-18)
   if (door) return null;
   if (account == null) {
-    if (principal.role === "staff") return null;   // staff without acting-for: caller decides (list-all views)
-    if (Array.isArray(principal.accounts) && principal.accounts.length === 1) return principal.accounts[0];
     if (principal.accounts === "*") return null;
-    throw new PortalDeny(400, "name an account (?account=) — this login covers several");   // multi-account client must name one — an actionable 400, never a lockout
+    if (Array.isArray(principal.accounts) && principal.accounts.length === 1) return principal.accounts[0];
+    throw new PortalDeny(400, principal.accounts?.length
+      ? "name an account (?account=) — this login covers several"
+      : "name an account (?account=) — this login holds no company of its own, only its organisation's Generic");
   }
   const a = String(account).trim().toLowerCase();
-  if (principal.role === "staff") return a;
-  // `generic` IS THE HOUSE ACCOUNT, AND IT IS REFUSED HERE RATHER THAN PER ROUTE.
-  //
-  // makePrincipal strips `generic` from a client's grant — but only on the ARRAY branch. A grant that
-  // resolves to the literal "*" returns above it, untouched, and the wildcard test below then admits
-  // `generic` like any other account. Three routes (the runs listing and the two report routes) carried
-  // their own `role !== "staff"` check and closed the hole for themselves; POST /portal/api/run and
-  // /run/plan never did. So the one path that spends money was the one path with no guard — against the
-  // one account that is EXEMPT from the daily run cap (runner.mjs: `generic` is the neutral no-customer
-  // profile and stays uncapped). Uncapped spend, reachable by a grant shape, is the worst combination
-  // in this file.
-  //
-  // Refusing at the chokepoint fixes every account-scoped route at once, including the ones nobody has
-  // written yet, which is the property the per-route checks could never have. Those three stay as they
-  // are: they are cheap, and defence in depth on a spend boundary is not duplication.
-  if (a === "generic") throw new PortalDeny(404, "not found");
+  if (a === "generic") {
+    genericOrgOf(principal, tenant);
+    return a;
+  }
   if (principal.accounts === "*" || (Array.isArray(principal.accounts) && principal.accounts.includes(a))) return a;
   throw new PortalDeny(404, "not found");
 }

package/driver/portal-config-view.mjs

@@ -10,7 +10,7 @@
 // ── THE FLAG PART ───────────────────────────────────────────────────────────────────────────────────
 //
 // This RENDERS the snapshot, NOT process.env, and that is still the rule — but the reason written here
-// until tracker issue 170 was measurably out of date, so it is restated rather than repeated. It said
+// until it was measurably out of date, so it is restated rather than repeated. It said
 // "portal-service's unit deliberately carries no environment file". It does:
 // `driver/systemd/clearotron-portal.service` carries `EnvironmentFile=%h/.env`, and sets
 // `CLEAROTRON_NO_ENV_FILE=1` precisely because systemd has already supplied it.
@@ -42,10 +42,11 @@
 // so rather than implying it has the whole picture.
 
 import { statSync, openSync, readSync, closeSync } from "node:fs";
+import { namedPoint } from "./portal-access.mjs";
 
 import { readFlagSnapshot, engineFor, providersFor, postureDisagreement } from "./flag-snapshot.mjs";
-// `isStale` is deliberately NOT imported any more: the age banner is retired (owner ruling, tracker
-// issue 170). The function stays exported for other readers; this page no longer asks how old a
+// `isStale` is deliberately NOT imported any more: the age banner is retired (ruling,
+// 2026-09-05). The function stays exported for other readers; this page no longer asks how old a
 // reading is, because the question it was standing in for — does this still describe the box — now has
 // a direct answer in `lastRun.disagrees`.
 import { engineMode } from "./config-inventory.mjs";   // — the mode is DERIVED at read time, never stored
@@ -110,7 +111,7 @@ function postureView(snap) {
 /**
  * The configuration view.
  *
- * THE ANSWER IS THE LIVE CONFIGURATION, ALWAYS — owner ruling 2026-09-05, on tracker issue 170:
+ * THE ANSWER IS THE LIVE CONFIGURATION, ALWAYS — ruling 2026-09-05:
  * "the global configuration page shows LIVE configuration, always. No run-time snapshot as the source of
  * truth — I don't see why it needs to take an old snapshot." Age banners go with it.
  *
@@ -269,87 +270,75 @@ export function authView({ mode = "", oidcIssuer = "", team = "", jwksUrl = "",
 }
 
 /**
- * Where the staff-domain rule was written, so a reader can go and undo it.
+ * The People page: who has access to what, narrowed to what the viewer may see, and where an enrolment
+ * is half done.
  *
- * ── WHY A PAGE THAT NAMES A RULE MUST ALSO NAME ITS ADDRESS ─────────────────────────────────────────
+ * `grants` is the parsed grants file and `viewer` the signed-in principal. A person is listed when at
+ * least one of their access points sits inside the viewer's own, and only those points are shown — a
+ * manager of one organisation sees a colleague's access to it and never that colleague's access
+ * elsewhere. A person who sees everything sees everyone. The narrowing is here, on the server, because
+ * a filter in the browser is a boundary drawn in markup.
  *
- * The People & access screen renders the rule — "Anyone at <domain> — a rule, not a person" — and said
- * nothing about where it came from. A reader who does not recognise the domain therefore learns that
- * strangers may hold an administrator's view of their instance and has no next step at all: the value
- * is in an environment variable, in one of two files depending on how the instance is run, and neither
- * is named anywhere on the screen. The one outside reader who met this reported it as a back door,
- * twice, which is the correct thing to do with an access rule you cannot trace.
- *
- * PURE, and it answers "could not tell" as itself. `envLoad` is `shared/env-local.mjs`'s own report of
- * what this process read, so the answer describes the process actually serving the page rather than
- * being composed from a path that some other process would have read — the distinction that module
- * exists for. A service started by systemd took its configuration from an EnvironmentFile; a child of
- * `clearotron start` was handed an explicit environment and read no file at all; a hand-run CLI read
- * the CLI's file. Each gets its own sentence, because the remedy is a different file in each.
+ * `companies` maps each company key the profile store holds to its name. `localSignIn` says this install
+ * cannot hold a second person at all, which is what disables Add.
  */
-export function staffRuleSource({ name = "PORTAL_STAFF_DOMAINS", value = "", envLoad = null,
-                                  unitEnvFile = null, cliEnvFile = null } = {}) {
-  if (!String(value ?? "").trim()) return null;
-  const reason = envLoad?.reason ?? null;
-  const applied = Array.isArray(envLoad?.applied) ? envLoad.applied : [];
-  if (reason === "read" && applied.includes(name))
-    return { name, where: `read from ${envLoad.path}` };
-  if (reason === "service-managed")
-    return { name, where: unitEnvFile ? `set in this service's environment file, ${unitEnvFile}` : "set in this service's environment" };
-  if (reason === "opted-out")
-    return { name, where: cliEnvFile
-      ? `handed to this service by the command that started it, which takes it from ${cliEnvFile} or derives it from the sign-in address`
-      : "handed to this service by the command that started it" };
-  return { name, where: cliEnvFile ? `set in this service's environment (the file it would otherwise read is ${cliEnvFile})` : "set in this service's environment" };
-}
-
-/**
- * The enrolment view: who is granted what, and where an enrolment is half done.
- *
- * `grants` is the parsed grants file. `staffDomains` are admitted by domain rather than by grant, so
- * they are reported separately — a staff member absent from the grants file is normal, not a fault,
- * and listing them as "unenrolled" would bury the real problems.
- */
-export function accessView({ grants, staffDomains = [], knownAccounts = [], grantsFile = null, staffRule = null }) {
+export function accessView({ grants, viewer = null, companies = {}, grantsFile = null, localSignIn = false }) {
   const tenants = grants?.tenants ?? {};
-  const known = new Set(knownAccounts);
-  const people = [];
+  const everything = viewer?.everything === true;
+  const viewerOrgs = viewer?.genericOrgs ?? [];
+  const viewerCompanies = Array.isArray(viewer?.accounts) ? viewer.accounts : [];
+  const inside = (p) => everything || (p.kind === "organisation" ? viewerOrgs.includes(p.key)
+    : p.kind === "company" ? viewerOrgs.includes(p.org) || viewerCompanies.includes(p.key) : false);
+  const known = new Set(Object.keys(companies));
   const unknownAccounts = new Set();
+  const rows = new Map();   // address as written → { points, dangling }
+  const row = (email) => { if (!rows.has(email)) rows.set(email, { points: [], dangling: [] }); return rows.get(email); };
 
   for (const [tenant, t] of Object.entries(tenants)) {
     const accounts = Array.isArray(t?.accounts) ? t.accounts : [];
-    for (const a of accounts) if (known.size && !known.has(a)) unknownAccounts.add(a);
-
+    for (const a of accounts) if (known.size && a !== "generic" && !known.has(a)) unknownAccounts.add(a);
     for (const [email, grant] of Object.entries(t?.users ?? {})) {
-      // "*" means every account this TENANT holds — not every account on the system. Expanding it here
-      // is what makes the page show what the person can actually reach, which is the question being
-      // asked; showing a literal "*" would need the reader to know that rule.
-      const resolved = grant === "*" ? accounts : Array.isArray(grant) ? grant : [];
-      const dangling = resolved.filter((a) => !accounts.includes(a));
-      people.push({
-        email,
-        tenant,
-        accounts: resolved,
-        // A grant naming an account its own tenant does not hold. Usually a typo, and it fails as a
-        // silent 404 for that person with nothing in any log to explain it.
-        dangling,
-        wildcard: grant === "*",
-      });
+      const r = row(email);
+      if (grant === "*") { r.points.push({ kind: "organisation", key: tenant }); continue; }
+      for (const a of Array.isArray(grant) ? grant : []) {
+        // A grant naming a company its own organisation does not hold. Usually a typo; it grants
+        // nothing, and the person meets a silent 404 with nothing in any log to explain it.
+        if (accounts.includes(a)) r.points.push({ kind: "company", key: a, org: tenant });
+        else if (everything || viewerOrgs.includes(tenant)) r.dangling.push(a);
+      }
     }
   }
+  const people = grants?.people && typeof grants.people === "object" ? grants.people : {};
+  for (const email of Object.keys(people)) row(email);
+
+  const list = [];
+  for (const [email, r] of rows) {
+    const key = Object.keys(people).find((k) => k.toLowerCase() === email.toLowerCase());
+    const entry = (key !== undefined ? people[key] : null) ?? {};
+    const pattern = email.startsWith("*@");
+    const all = entry.everything === true && !pattern ? [{ kind: "everything" }]
+      : r.points.filter((p) => p.kind === "organisation" || !r.points.some((q) => q.kind === "organisation" && q.key === p.org));
+    const shown = everything ? all : all.filter(inside);
+    if (!everything && !shown.length) continue;
+    list.push({
+      email,
+      permissions: { run: entry.run === true, manage: entry.manage === true && !pattern },
+      access: shown.map((p) => namedPoint(p, grants, companies)),
+      dangling: r.dangling,
+    });
+  }
 
   return {
-    people: people.sort((a, b) => a.email.localeCompare(b.email)),
-    staffDomains: [...staffDomains],
-    // An ADDITIONAL field rather than a reshape of `staffDomains`: that array is parsed by the browser
-    // contract and read by three screens' worth of arms, and a rule nobody can trace is a copy problem,
-    // not a data-shape problem. Null when there is no rule, or when the source could not be told.
-    staffRule,
-    // Accounts named in grants that no profile matches — the other typo direction.
-    unknownAccounts: [...unknownAccounts].sort(),
+    people: list.sort((a, b) => a.email.localeCompare(b.email)),
+    // Add is offered to a manager, and never where local sign-in holds the install to one person.
+    canAdd: viewer?.permissions?.manage === true && !localSignIn,
+    localSignIn,
+    // Companies named in grants that no profile matches — the other typo direction. Install-wide, so it
+    // is shown to a person who sees everything and to nobody else.
+    unknownAccounts: everything ? [...unknownAccounts].sort() : [],
     // Where to go to change any of this — a filename and a date, so "I want to add someone" has a
     // visible next step instead of ending at a page that only reports. Null when it cannot be stat'd.
-    grantsFile,
+    grantsFile: everything ? grantsFile : null,
     // Stated plainly, because this view genuinely cannot see the other half.
     //
     // — IT NO LONGER NAMES ONE VENDOR, and it no longer asserts an edge that may not exist. This

package/driver/portal-report.mjs

@@ -145,7 +145,7 @@ const CHROME_RES = [
 
   // ── the engine's own scaffolding: out of the report, for EVERY reader ───────────────────────────────
   //
-  // Owner ruling, 2026-07-27: "none of this should surface to anyone — only to the internal logs for
+  // Ruling, 2026-07-27: "none of this should surface to anyone — only to the internal logs for
   // analysis." Not a client cut and a staff cut; there is ONE report, and this material was never meant to
   // be in it for anybody. It reads as machinery in a document whose whole job is a legal opinion.
   //
@@ -525,7 +525,7 @@ const EMBED_JS = `
     queued=true;
     requestAnimationFrame(function(){queued=false;post();});
   }
-  // WHICH CONTROLS THIS DOCUMENT ACTUALLY HAS (tracker issue 1922).
+  // WHICH CONTROLS THIS DOCUMENT ACTUALLY HAS.
   //
   // The command handler below answers "this report has no <verb>" for a verb the document does not
   // define. That reply is honest and it arrives too late: the shell had already drawn a menu item, the
@@ -890,7 +890,7 @@ export function reportsOf(meta) {
  * NOTHING COULD REACH IT. `meta.reports` lists the per-mark HTMLs only, so `resolveReportFile` below
  * matches nothing for it and the portal route 404s; the pool path is not one the edge serves either
  * (test/edge-routes.mjs — one legacy filename, and it is `report.html`). Good prose, composed on every
- * multi-mark run, delivered to nobody. Owner ruling 2026-08-26: the grouped page carries it.
+ * multi-mark run, delivered to nobody. Ruling 2026-08-26: the grouped page carries it.
  *
  * Returns PARAGRAPHS, split the way the document renderer splits them, with inline markdown left in
  * place — the model writes markdown because every surface it feeds renders markdown, and the client
@@ -917,7 +917,7 @@ export function batchSummaryOf(dir) {
   // reading to the end of the file would ship that list and this boundary is load-bearing.
   //
   // — IT USED TO TERMINATE ON ANY HEADING, /^#{1,6}\s/, AND THAT SILENTLY TRUNCATED THE PAGE.
-  // The writer now emits sub-headers INSIDE the summary (owner ruling 2026-08-31, "keep the length, add
+  // The writer now emits sub-headers INSIDE the summary (ruling 2026-08-31, "keep the length, add
   // the structure"). Measured on a ten-line structured summary before the fix: the section ended at the
   // first `## <MARK>` and the grouped page — the report's entry point — rendered ONE sentence, with
   // every following mark dropped and nothing anywhere reporting a loss. Depth cannot mark this boundary