clearotron 0.3.1-beta.2 → 0.3.1-beta.3

package/mcp-server/lib/http-handler.mjs

@@ -10,7 +10,7 @@
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { AuthError } from "./cf-access.mjs";
 import { appendAudit } from "./audit.mjs";
-import { resolveScope, isFirmDomain, verifyToken } from "./scope.mjs";
+import { resolveScope, isFirmDomain, verifyToken, addressesInGrants } from "./scope.mjs";
 
 const hdr = (v) => (Array.isArray(v) ? v[0] : v);
 
@@ -69,13 +69,63 @@ export function evictOldest(sessions) {
  * presents another identity's mcp-session-id is refused (403) — a leaked/guessed session id must never
  * let one CF-authed person attach to another's session (which may carry an ops-scoped inner token).
  */
-export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions, createSession, ns = "trademark-artifacts", sessionMax = 500, maxBody = 4 * 1024 * 1024, authHeader = "cf-access-jwt-assertion", firmDomains = [], clientSurface = false, devMode = false, tokenOnly = false, keyDoorPath = null, log = () => {} }) {
+export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions, createSession, ns = "trademark-artifacts", sessionMax = 500, maxBody = 4 * 1024 * 1024, authHeader = "cf-access-jwt-assertion", firmDomains = [], clientSurface = false, devMode = false, tokenOnly = false, keyDoorPath = null,
+  // Is this identity still on the guest list? ASKED PER REQUEST on an ACCOUNT session, cached on the
+  // grants file's mtime, so it costs a stat between edits. Injected so an arm can move the answer
+  // without a file; the default is the real read, because a door composed without this seam would
+  // silently go back to resolving reach once and holding it for half an hour.
+  stillEnrolled = (email) => addressesInGrants().includes(String(email ?? "").trim().toLowerCase()),
+  log = () => {} }) {
   if (!verify && !devMode && !tokenOnly) throw new Error("makeHttpHandler: verify is required unless devMode:true or tokenOnly:true (fail-closed; refusing to build an unauthenticated handler)");
   // The two verify-less modes mean OPPOSITE things and must never be combined: devMode trusts the local
   // operator and hands out a synthetic identity, tokenOnly trusts NOBODY without a valid key. Together,
   // the synthetic identity would be the thing that answers — an open door wearing a locked door's label.
   if (tokenOnly && devMode) throw new Error("makeHttpHandler: tokenOnly and devMode are mutually exclusive (devMode's synthetic identity would defeat the mandatory key)");
   if (tokenOnly && verify) throw new Error("makeHttpHandler: tokenOnly is for a door with no auth proxy in front — pass verify:null");
+
+  /**
+   * Has this identity been taken off the guest list since its session was opened? Null when it has not,
+   * or when the question does not apply — and the body to send back when it has.
+   *
+   * ── WHY THIS IS ASKED AGAIN AT ALL ──────────────────────────────────────────────────────────────
+   *
+   * An ACCOUNT session's reach is resolved ONCE, at `resolveScope`, and lives in the server the
+   * transport was built around. After that, this branch compared the caller's email against the
+   * session's and nothing else — so somebody removed from an installation kept a whole account's reach
+   * through their assistant until the session went idle for `SESSION_TTL_MS`, half an hour by default.
+   * The portal's own side has never had that gap: it reads the file on every request. The People page
+   * now tells a manager that removing somebody takes their access away "straight away, here and through
+   * their AI", and this is what makes the second half of that sentence true rather than nearly true.
+   *
+   * ── WHY IT IS THIS NARROW ───────────────────────────────────────────────────────────────────────
+   *
+   * Four kinds of session reach this branch and only one of them is answerable from the guest list.
+   * A run-bound `user` session and an `ops` session carry a token whose subject is a run id or an
+   * automation principal, neither of which is an address anybody enrols; `internal` is firm staff,
+   * admitted by a domain rule that does not live in this file. Asking the guest list about any of them
+   * would refuse a caller for not being something they were never supposed to be — so the gate is the
+   * client surface and the `account` kind, which is exactly the population the removal sentence is
+   * about. Every other session behaves as it did.
+   *
+   * ── AND WHY IT FAILS CLOSED ─────────────────────────────────────────────────────────────────────
+   *
+   * A guest list that names nobody refuses. `CLEAROTRON_ACCESS_FILE` is mandatory on any door that can
+   * hold an account session (the boot guard exits on its absence), and the file is written by an atomic
+   * rename, so a reader sees the old file or the new one and never a torn one. An empty answer is
+   * therefore a real state — the file was emptied, or it stopped parsing — and not a transient worth
+   * holding a door open for.
+   */
+  const revokedMidSession = (entry) => {
+    // WHO, read off the SCOPE and never off `user.email`. The two are the same address on a
+    // CF-fronted door and are NOT on the others: a key door names the token's subject, and dev mode
+    // hands out a synthetic identity that was never enrolled anywhere. Asking the guest list about the
+    // synthetic one refuses every session on a developer's box, which is how this was found.
+    if (!clientSurface || entry?.kind !== "account" || !entry?.sub) return null;
+    if (stillEnrolled(entry.sub)) return null;
+    log(`session withdrawn mid-session: ${entry.sub} is no longer on this installation's guest list`);
+    return { error: "your access to this installation has been withdrawn — ask whoever manages it, then start a new session" };
+  };
+
   return async (req, res) => {
     try {
       // THE BASE IS A CONSTANT, AND WHAT THE `Host` HEADER IS USED FOR HERE IS: NOTHING. Only
@@ -175,6 +225,7 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
 
         const sid = hdr(req.headers["mcp-session-id"]);
         let entry = sid ? sessions.get(sid) : null;
+        let stampScope = null;
         if (!entry) {
           if (sid) return send(res, 404, { error: "unknown or expired session" });
           if (!isInitializeRequest(body)) return send(res, 400, { error: "no session — the first request must be an MCP initialize" });
@@ -204,11 +255,29 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
           }
           const transport = await createSession(sessions, scope, user.email);
           entry = { transport, sub: scope.sub ?? null, kind: scope.kind ?? null };
+          // STAMP THE SCOPE'S OWN FACTS ONTO THE STORED ENTRY, HERE, AND AFTER THE HANDSHAKE.
+          //
+          // `createSession` is injected, and every caller carries its own copy of the entry shape — two
+          // servers and every arm that builds a door — so `sub` and `kind` are recorded by some of them
+          // and omitted by others. A gate reading either would be true about whichever copies happened
+          // to set it and silently inert everywhere else, which is the one failure a gate must not have.
+          // The local `entry` above is this request's only; the map's is what every later request reads.
+          //
+          // AFTER, because the session has no id until the transport has answered the initialize: the
+          // id is minted inside `handleRequest`, and `onsessioninitialized` is what puts the entry in
+          // the map. Stamping before that read `sessions.get(undefined)`, found nothing, wrote nothing,
+          // and left the gate reading a field nobody had set — green, and doing nothing.
+          stampScope = () => {
+            const stored = transport.sessionId ? sessions.get(transport.sessionId) : null;
+            if (stored) { stored.sub = scope.sub ?? null; stored.kind = scope.kind ?? null; }
+          };
         } else {
           if (entry.email && entry.email !== user.email) {
             log(`session owner mismatch: ${user.email} presented a session created by another identity`);
             return send(res, 403, { error: "session belongs to another identity" });
           }
+          const gone = revokedMidSession(entry);
+          if (gone) return send(res, 403, gone);
           entry.lastSeen = Date.now();
         }
         // OPS-TOKENS item 6 — automation principals get their own (lower) bucket, keyed by the token's
@@ -219,7 +288,9 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
         // Audit AFTER scope resolution so the line names the PRINCIPAL (token sub), not just the
         // transport identity — still strictly before any tool dispatch. Best-effort, never blocks.
         try { appendAudit({ email: user.email, sub: entry.sub ?? null, body }); } catch { /* best-effort */ }
-        return entry.transport.handleRequest(req, res, body);
+        const answered = entry.transport.handleRequest(req, res, body);
+        if (stampScope) { try { await answered; } finally { stampScope(); } }
+        return answered;
       }
 
       if (req.method === "GET" || req.method === "DELETE") {
@@ -230,6 +301,8 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
           log(`session owner mismatch: ${user.email} presented a session created by another identity`);
           return send(res, 403, { error: "session belongs to another identity" });
         }
+        const gone = revokedMidSession(entry);
+        if (gone) return send(res, 403, gone);
         entry.lastSeen = Date.now();
         return entry.transport.handleRequest(req, res);
       }

package/mcp-server/lib/runs.mjs

@@ -70,11 +70,23 @@ function runFromStatusFile(statusFile, agent) {
 // exist". `mark` is the name-shaped filter: case-insensitive, on a PART of the word, and
 // over the mark name AND the slug, because a client may hold either. `slug` stays exact — enumerateRuns
 // has driver consumers (status-snapshot.mjs, repair-digest.mjs) that pass a slug meaning that one run.
+//
+// AND OVER THE CLIENT'S NAME AND THE PROJECT'S, which is the same defect a second time. A lawyer asked
+// for one client's recent searches by that client's name; every row matched the mark filter on nothing,
+// the list came back empty, and the assistant answered that no such search existed — of work delivered
+// to that client the same day. The note above records the first instance and fixed only the name the
+// mark is filed under. A name-shaped question is asked with whichever name the asker holds, and for a
+// firm acting for many clients that is the client's as often as the mark's.
+//
+// IT WIDENS WHAT IS FOUND, NEVER WHO MAY SEE IT. The account gate runs on the RESULT of the tool call
+// (filterByAccounts), after this, so a scoped session naming another firm's client still receives
+// nothing — the row is found here and dropped there, exactly as a row found by mark name always was.
 function markMatches(run, mark) {
   const needle = String(mark).trim().toLowerCase();
   if (!needle) return true;
-  return String(run.markName ?? "").toLowerCase().includes(needle)
-      || String(run.slug ?? "").toLowerCase().includes(needle);
+  const facts = runProfileFacts(run);
+  return [run.markName, run.slug, facts.clientName, facts.projectName]
+    .some((field) => String(field ?? "").toLowerCase().includes(needle));
 }
 
 // All runs (newest-first), optionally filtered by agent / state / slug / mark.
@@ -191,6 +203,34 @@ export function runAccountKey(run) {
   } catch { return null; }
 }
 
+// WHO THE RUN WAS FOR, from the sidecar the driver freezes at the start of every run. The engine has
+// always known this — `runAccountKey` reads the same file to decide who may SEE a run — and no surface
+// ever showed it, so a list of eight runs for two clients named neither.
+//
+// A SEPARATE READER RATHER THAN A REFACTOR of the two below. Those two are the access path: the grants
+// tests pin them against the real frozen shape, the legacy `{key}` shape and the unreadable case, and
+// this issue asks for a field on a row rather than a rewrite of who can see what. The cost is one more
+// parse of a small file on the calls that ask for these facts.
+//
+// AN UNREADABLE SIDECAR IS ANSWERED, NOT OMITTED. A row with no client field reads as a run belonging
+// to nobody in particular, which is how eight rows managed to say nothing about who they were for;
+// `known: false` says the engine cannot tell, which is a different sentence and an actionable one.
+export function runProfileFacts(run) {
+  try {
+    const p = JSON.parse(readFileSync(driverDir(run.runDir, "profile.json"), "utf8"));
+    const key = p.profileKey ?? p.key ?? null;
+    return {
+      known: true,
+      account: key,
+      clientName: typeof p.name === "string" && p.name ? p.name : null,
+      projectKey: typeof p.projectKey === "string" && p.projectKey ? p.projectKey : null,
+      projectName: typeof p.projectName === "string" && p.projectName ? p.projectName : null,
+    };
+  } catch {
+    return { known: false, account: null, clientName: null, projectKey: null, projectName: null };
+  }
+}
+
 // A Generic run's organisation, from the same frozen sidecar. Null for a company's run, for one filed
 // before organisations existed, and for an unreadable sidecar — each of which the account gate treats as
 // visible only to a full-grant session.

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.1-beta.2",
+  "version": "0.3.1-beta.3",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/mcp-server/packs/client/CONNECT.md

@@ -1,21 +1,25 @@
 # Connect your AI to your clearance report
 
-Your report has an **"Ask your AI"** panel with a personal connector address. It is scoped to this
-one search, read-only, and self-contained — adding it takes a minute.
+Connect once, and the **Ask AI** button on any of your reports opens Claude or ChatGPT with a question
+about that report already typed in.
 
-**Treat the address like the report itself**: it embeds your access credential. Don't forward it
-beyond the people who may read the report. It expires on its own (typically 30 days).
+Your connector address is on the **Use your own AI** page in the portal, not on the report. It is
+read-only and takes a minute to add.
+
+**Treat the address like the report itself**: it carries your access. Don't forward it beyond the
+people who may read the report.
 
 ## Claude — Desktop or claude.ai (recommended)
 
 1. **Settings → Connectors** (paid plan required).
-2. **Add custom connector** → paste the address from your report → **Add**.
-3. Ask: *"Brief me on this clearance search."*
+2. **Add custom connector** → paste the address from the Use your own AI page → **Add**.
+3. Open a report and press **Ask AI → Ask Claude**.
 
 ## ChatGPT — Business / Enterprise / Edu
 
 1. **Settings → Connectors → Advanced → Developer mode** (an admin may need to enable it).
 2. **Add a connector / MCP server** → paste the address.
+3. Open a report and press **Ask AI → Ask ChatGPT**.
 
 ## Command-line / IDE tools (Claude Code, Cursor, …)
 

package/mcp-server/server.mjs

@@ -20,6 +20,7 @@
 import "../shared/env-local.mjs";   // side effect: apply <repo>/.env when THIS file is the CLI entry (never on library import)
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { appendAudit } from "./lib/audit.mjs";
 import {
   ListToolsRequestSchema, CallToolRequestSchema,
   ListResourcesRequestSchema, ReadResourceRequestSchema, ListResourceTemplatesRequestSchema,
@@ -30,7 +31,7 @@ import { join, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { fileURLToPath } from "node:url";
 
-import { enumerateRuns, resolveRun, runAccountKey, runOrganisation } from "./lib/runs.mjs";
+import { enumerateRuns, resolveRun, runAccountKey, runOrganisation, runProfileFacts } from "./lib/runs.mjs";
 import { ORDERABLE_PRODUCTS } from "../driver/search-policy.mjs";
 import { PRODUCTS } from "../driver/products.mjs";
 
@@ -179,8 +180,19 @@ function getStages(runDir) {
 
 function runSummary(run) {
   const s = run.status ?? {};
+  // WHO THE SEARCH WAS FOR, on every row. A session that holds several clients was handed eight rows
+  // naming none of them, so no reading of that list could answer "which of these is for <client>" —
+  // and the assistant answered that none were, of a search delivered to that client the same day. The
+  // engine knew: the same sidecar decides who may see the run, and it was read for the gate and never
+  // shown. An unreadable one says so on the row rather than leaving the field out, because a missing
+  // field is what made the list unanswerable in the first place.
+  const facts = runProfileFacts(run);
   return {
     runId: run.runId, slug: run.slug, codename: run.codename, date: run.date, agent: run.agent,
+    client: facts.known
+      ? { key: facts.account, name: facts.clientName }
+      : { key: null, name: null, known: false, note: "this run's client could not be read from its own record" },
+    project: facts.projectKey ? { key: facts.projectKey, name: facts.projectName ?? facts.projectKey } : null,
     state: run.state, location: run.location, verdict: run.verdict, url: run.url,
     markName: run.markName, ref: run.ref, classes: run.classes,
     step: s.stepN ? `${s.stepN}/${s.stepTotal} ${s.stepLabel ?? ""}`.trim() : null,
@@ -603,7 +615,7 @@ const TOOL_DEFS = [
   // recipient is a lawyer who layers advice on top, and a tool description promising advice is how it
   // comes back. The brief names WHICH PRODUCT the run was instead, resolved from the registry.
   { name: "brief", description: "START HERE for any 'what do you have on X / what did the search find' question — ONE plain-language briefing of a run, in the client-voiced wording (which search product this run was, overall risk in plain words, each conflict in 1–2 plain sentences, any conditions on the result). Facts, never advice. No internal stage names, no risk-formula codes, no model names. Reach for the audit tools (get_run, trace, decision_timeline, get_telemetry) only when the user asks HOW the system reached a conclusion.", inputSchema: { type: "object", properties: { ...runIdProp }, required: ["runId"] } },
-  { name: "list_runs", description: "List the searches on this account (in progress and finished), newest first. TO FIND A SEARCH BY THE NAME IT CLEARED, pass `mark` — the stored identifier is a longer prefixed slug a client has never seen, so a bare mark name will not match `slug`. If a filtered call comes back empty, list unfiltered and read down the mark names before telling anyone there is nothing there. States: 'postponed' = paused on a provider cap and resuming by itself (resetsAt); 'recovering' = backing off and retrying (recoveryResumesAt); 'parked-for-human' = interrupted mid-search, resumes on the next activation. sendPending:true is the authoritative list of finished searches still owed their delivery notification. Follow up with brief for a plain-language summary of one search.", inputSchema: { type: "object", properties: { agent: { type: "string" }, state: { type: "string", enum: ["running", "delivered", "failed", "postponed", "recovering", "parked-for-human", "cancelled"] }, mark: { type: "string", description: "Find a search by the MARK it cleared: matches the mark name or the identifier, case-insensitively, on part of the word. This is the parameter a name-shaped question wants." }, slug: { type: "string", description: "EXACT identifier match, for a caller that already holds one. A mark name is not a slug — use `mark`." }, sendPending: { type: "boolean", description: "true = only searches still owed a delivery notification; false = only already-settled ones." }, limit: { type: "number" } } } },
+  { name: "list_runs", description: "List the searches this session can see (in progress and finished), newest first. A session may hold more than one client, so the list is NOT one client's: every row names the client it was run for, and the project where there is one. TO FIND ONE CLIENT'S SEARCHES, pass `mark` with the client's name — the same name-shaped filter reads the client and the project as well as the mark. TO FIND A SEARCH BY THE NAME IT CLEARED, pass `mark` — the stored identifier is a longer prefixed slug a client has never seen, so a bare mark name will not match `slug`. If a filtered call comes back empty, list unfiltered and read down the mark names before telling anyone there is nothing there. States: 'postponed' = paused on a provider cap and resuming by itself (resetsAt); 'recovering' = backing off and retrying (recoveryResumesAt); 'parked-for-human' = interrupted mid-search, resumes on the next activation. sendPending:true is the authoritative list of finished searches still owed their delivery notification. Follow up with brief for a plain-language summary of one search.", inputSchema: { type: "object", properties: { agent: { type: "string" }, state: { type: "string", enum: ["running", "delivered", "failed", "postponed", "recovering", "parked-for-human", "cancelled"] }, mark: { type: "string", description: "Find a search by NAME: the mark it cleared, the client it was run for, the project it was run under, or the identifier — case-insensitively, on part of the word. This is the parameter a name-shaped question wants, whichever of those names the asker holds." }, slug: { type: "string", description: "EXACT identifier match, for a caller that already holds one. A mark name is not a slug — use `mark`." }, sendPending: { type: "boolean", description: "true = only searches still owed a delivery notification; false = only already-settled ones." }, limit: { type: "number" } } } },
   { name: "list_profiles", description: "List the customer ACCOUNTS the firm runs clearotron clearances for (key + name + industry + their PROJECTS) — the roster the intake step resolves a job's profileKey (and optional projectKey) against. profileKey selects that customer's marketplaces, default classes/jurisdictions, report format and risk posture; a project (spec 62) is an engagement UNDER a customer that overlays its own marketplaces/classes/sector/posture. Resolve by JUDGMENT (explicit name, misspelling, or implicit reference); OMIT profileKey for a new/unknown customer (uses the neutral generic profile — a customer who does not exist here yet never blocks a search; tell the requester it is running under the neutral profile, and that their own company can be set up in the portal if they want its framework, territories and marketplaces applied instead); set projectKey only when the request names a specific project in that customer's projects[], else OMIT it (runs on the customer profile); never pick a profile from the sender's email domain. Read-only.", inputSchema: { type: "object", properties: {} } },
   { name: "get_run", description: "ENGINEERING/AUDIT view — full run mechanics: status, every pipeline stage (trigger/outcome), failover facts, artifact validity, and a coverage summary. Use when the user asks how the run executed; for 'what did it find', call brief instead.", inputSchema: { type: "object", properties: { ...runIdProp }, required: ["runId"] } },
   { name: "read_artifact", description: "Read a run artifact's raw text (or one '# Section', or its front-matter). For briefing a person, the report is the plain-language layer; the rest are internal working documents. Names: report, audit, narrative, registerFindings, commonLaw, placement, matterContext, variantManifest, skepticFlags, seniorEyeReview, caseLaw, clientSummary (internal cover-note source; ops only), a register axis (e.g. primary-sweep), status.json, run.jsonl.", inputSchema: { type: "object", properties: { ...runIdProp, name: { type: "string" }, section: { type: "string", description: "Return only this '# Section'." }, frontMatterOnly: { type: "boolean" } }, required: ["runId", "name"] } },
@@ -739,6 +751,13 @@ export function promptText(kind, name) {
 const CLIENT_TOOL_TEXT = {
   read_artifact: (kind) =>
     `Read one of this search's documents, or a single "# Section" of one. "report" is the report itself — the plain-language layer, and the right answer to almost every question about what the search concluded. Readable here: ${[...(kind === "user" ? USER_ARTIFACTS : ACCOUNT_ARTIFACTS)].join(", ")}${kind === "user" ? "" : ', or one register pass as "registerUnit:<axis>". "commonLaw" carries the off-register use layer AND the meaning-and-connotation reading — read it before saying a search did not look at what a name means'}. Anything else on the search is internal and refused by name.`,
+  // THE DESCRIPTION WAS HALF THE DEFECT, and this tool had no client cut at all — so a lawyer's session
+  // was handed the operator's line, "the searches on this account", while holding several clients. Told
+  // the list is one client's, an empty result reads as "that client has nothing" rather than "this list
+  // was not asked the right way". It names no client and offers no way to enumerate them: it says the
+  // rows carry their own, which is true whatever this session happens to hold.
+  list_runs: () =>
+    "Every search this session can see, newest first, in progress and finished. Each row says which client the search was run for, and which project where there is one — so a session acting for several clients can tell them apart without asking again. To find one client's searches, pass `mark` with that client's name; the same filter also matches the mark and the project, on part of the word, case-insensitively. If a filtered call comes back empty, list unfiltered and read down the rows before telling anyone there is nothing there. Follow up with brief for a plain-language summary of one search.",
   get_run: () =>
     "What actually happened during this search: which steps ran, in what order, what each produced, whether anything was retried, and where it stands now. Use it when the user asks how the search was carried out; for what it found, call brief instead.",
   trace: () =>
@@ -1063,6 +1082,21 @@ export { tools, TOOL_DEFS, NS, log };
 const isMain = isEntrypoint(import.meta.url);
 if (isMain) {
   makeServer().connect(new StdioServerTransport())
-    .then(() => log("ready — read-only interrogation + gated what-if over clearotron runs"))
+    .then(() => {
+      log("ready — read-only interrogation + gated what-if over clearotron runs");
+      // ── LEAVE A RECORD THE PORTAL CAN READ ────────────────────────────────────────────────────────
+      //
+      // The HTTP doors write the caller's email to the access log on every request; this route wrote
+      // nothing, so a reader whose only connector is the local one was invisible to the portal and its
+      // Ask-AI control could only offer them setup they had already done.
+      //
+      // NO EMAIL, AND NONE IS SYNTHESIZED. This transport has no signed-in identity — it is a process an
+      // assistant spawned on somebody's own machine — and an invented address would match a person who
+      // did nothing. The record says what is true: a connector on this box was started over the local
+      // route. On an install with no hosted client door the reader IS the operator, which is the same
+      // split `stdioConnectOffer` already trusts, so that fact answers the question by itself; on a
+      // hosted install it answers for nobody and the portal ignores it.
+      appendAudit({ email: null, sub: null, body: { method: "initialize" }, status: "connected", transport: "stdio" });
+    })
     .catch((e) => { log(`fatal: ${e?.stack ?? e}`); process.exit(1); });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.1-beta.2",
+  "version": "0.3.1-beta.3",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",