clearotron 0.3.1-beta.2 → 0.3.1-beta.4

package/driver/portal-service.mjs

@@ -89,7 +89,7 @@ export function opsTokenFor({ bootToken, roster, mint }) {
 // has held the signing secret on both start paths for as long as both have existed. The comment has been
 // corrected in place rather than left to be trusted.
 import { mintToken, loadGrants, resolvePerson, addressesInGrants } from "../shared/scope.mjs";
-import { withPerson, withCompany } from "../shared/grants-edit.mjs";
+import { withPerson, withoutPerson, personPoints, withCompany } from "../shared/grants-edit.mjs";
 import { resolvePort } from "../shared/listen.mjs";   // — the port SOURCE, decided once
 import { fileURLToPath } from "node:url";
 
@@ -1082,6 +1082,59 @@ function outcomeRow({ event = "request-refused", method, path, email = null, sta
   return row;
 }
 
+/**
+ * Revoking the connector keys a removed person holds — composed here, exported so it can be driven.
+ *
+ * It is the portal's half of an act `clearotron disconnect` also performs, through the same module, so
+ * one author decides what revoking means. What differs is WHERE each runs, and the difference decides
+ * what each may do: `disconnect` runs on the box beside the door, and this runs in a web request in a
+ * different service with a different environment.
+ */
+export function makeConnectorKeyRevoker({ env = process.env, home = null } = {}) {
+  return async ({ email, grants: g }) => {
+    const { recordedKeysFor, disablePlan, applyDisablePlan, denylistPathFor } = await import("../shared/client-door.mjs");
+    const { homedir } = await import("node:os");
+    const { existsSync, mkdirSync, writeFileSync, appendFileSync } = await import("node:fs");
+    const { join, dirname } = await import("node:path");
+    const base = home ?? homedir();
+    const recorded = recordedKeysFor(g, email);
+    const plan = disablePlan({ env, unitDir: join(base, ".config", "systemd", "user"), exists: existsSync,
+      identity: email, recorded, denylistPath: denylistPathFor(env, base) });
+    if (!plan.possible) return { grants: g, revoked: 0, jtis: [], lateArm: false, says: plan.says };
+    if (plan.lateArm) return { grants: g, revoked: 0, jtis: plan.jtis, lateArm: true, says: plan.says ?? [] };
+    // THE RECORD IS NEVER STRUCK FROM HERE, and the ledger step is dropped rather than no-opped.
+    //
+    // `disablePlan` decides `lateArm` from the environment it is handed, and the environment this
+    // process has is the PORTAL's. The connector is a different unit with its own `EnvironmentFile`, so
+    // a box where the portal names a revocation list and the door was started without one reads as
+    // `lateArm: false` here — and the plan would then write the list AND strike the record, for a key
+    // that still works. A record removed while its key works is the only trace of that key, gone: the
+    // failure `client-door.mjs` states its ordering rule to prevent.
+    //
+    // So this process does the half it can vouch for. Writing the list is safe in both configurations —
+    // it is the right act where the door reads it and a file nobody opens where it does not. Leaving the
+    // record is safe in both too: `connectKeyReport` already judges a record valid, expired or revoked,
+    // so a record of a revoked key is an accurate one, and `clearotron doctor` is where an operator sees
+    // which. `clearotron disconnect` runs on the box, beside the door, and still strikes.
+    //
+    // The seam THROWS rather than doing nothing, so that a future change putting the ledger step back
+    // fails here instead of quietly striking again.
+    const revokeOnly = { ...plan, steps: plan.steps.filter((step) => step.id === "revoke") };
+    applyDisablePlan(revokeOnly, {
+      appendDenylist: (path, jtis) => {
+        mkdirSync(dirname(path), { recursive: true });
+        if (!existsSync(path)) writeFileSync(path, "# Revoked key ids, one jti per line. Read on every key check.\n", { mode: 0o600 });
+        appendFileSync(path, jtis.map((j) => `${j}\n`).join(""));
+      },
+      strikeRecords: () => {
+        throw new Error("the portal must not strike a key record: it cannot see the connector's environment, "
+          + "so it cannot know whether the revocation list it just wrote is the one that door loaded");
+      },
+    });
+    return { grants: g, revoked: plan.jtis.length, jtis: plan.jtis, lateArm: false, recordKept: true };
+  };
+}
+
 export function makePortalService({
   poolRoot, workspaceRoot, recipesDir = undefined, secret,
   grants = null,
@@ -1094,6 +1147,14 @@ export function makePortalService({
   // CLEAROTRON_ACCESS_FILE. Null means this service cannot write the file, and the routes that would
   // need to say so rather than pretend.
   writeGrants = null,
+  // Revoking the connector keys a removed person holds. INJECTED for the reason `writeGrants` is: this
+  // constructor stays pure over its inputs, an arm can watch the revocation without a denylist file on
+  // disk, and boot is where the paths live. It takes the grants object the removal produced and returns
+  // it with the struck records gone, so one write lands both facts.
+  //
+  // Null means this service cannot revoke, and the answer SAYS so — a removal that quietly left a live
+  // key would be the exact failure the page's own sentence promises against.
+  revokeConnectorKeys = null,
   // The queue directories the RUNNER drains — the same list it hands checkRunCaps. The allowance counter
   // and the quota pre-check read their ledger beside these, so they count what the wall counts (:
   // they used to reconstruct a workspace-relative path that resolved to nothing once the queue moved out
@@ -2316,6 +2377,52 @@ export function makePortalService({
 // cache, and a failure that answers `null` rather than throwing — a page that cannot read its door says
 // so, which is the honest half of this change.
 let doorKindCache = { at: 0, url: null, kind: null };
+// ── WHETHER A READER HAS AN ASSISTANT ON THIS INSTALLATION ────────────────────────────────────────
+//
+// The only evidence either process holds is the connector's own access log: enrolment says a person MAY
+// connect, never that they did. `readConnections` is the connector's reader, imported rather than
+// rebuilt here — the path this log lives at is the connector's fact, and a portal deriving it from its
+// own environment is how a live key's record nearly got struck on a split install.
+//
+// TWO INSTALLATION SHAPES, AND THE SPLIT IS THE ONE THE ROUTE ALREADY MAKES. A hosted install has a
+// published client door and many signed-in people, so the question is answered per person: is this
+// email in the log. A local install has no client door, one reader, and a connector that cannot know
+// who it is serving — so the local route's own record answers for the only person who could be asking.
+// Reading a local record as an answer on a HOSTED install would mark every reader connected the moment
+// one member of staff ran the server by hand, which is why it is gated on there being no client door.
+//
+// Returns null, never false, when there was nothing to read. See the route for why that matters.
+//
+// CACHED FOR A MINUTE, the same as the door probe above and for the same reason: this is a page load,
+// not a check. It runs on every report a reader opens, and reading the tail of a log each time to
+// answer a question whose answer changes once, ever, would be paid on the client-facing screen.
+// KEYED ON THE FILES IT READ, not on time alone. The log's location is configuration and does not move
+// under a running service — but a cache that ignored it would answer about the wrong file for a minute
+// after it did, and it is what makes this cache testable at the route rather than only at the helper.
+let connectionsCache = { at: 0, key: null, seen: null };
+const CONNECTIONS_TTL_MS = 60_000;
+
+async function readerHasConnectedAi(principal) {
+  const email = String(principal?.email ?? "").trim().toLowerCase();
+  let seen = null;
+  // Imported here rather than at the top, the way every other reach into mcp-server/lib from this file
+  // is: the driver does not depend on the connector, and the import-cycle walk is what keeps it so.
+  let audit = null;
+  try { audit = await import("../mcp-server/lib/audit.mjs"); }
+  catch { return null; }                                            // best-effort: never fail a page load
+  const key = audit.auditPaths().join("\u0000");
+  if (connectionsCache.seen && connectionsCache.key === key && Date.now() - connectionsCache.at < CONNECTIONS_TTL_MS) {
+    seen = connectionsCache.seen;
+  } else {
+    try { seen = audit.readConnections(); } catch { return null; }
+    connectionsCache = { at: Date.now(), key, seen };
+  }
+  if (!seen.available) return null;
+  if (email && seen.emails.has(email)) return true;
+  if (!process.env.CLEAROTRON_CLIENT_MCP_URL && seen.local) return true;
+  return false;
+}
+
 const DOOR_KIND_TTL_MS = 60_000;
 async function connectorDoorKind(url) {
   if (!url) return null;
@@ -2402,6 +2509,18 @@ async function connectorDoorKind(url) {
           email: principal.email ?? null,        // the identity to sign in with — what they already use
           enabled: !!url,
           stdio,                                 // the local route, or null for a client
+          // ── HAS THIS READER ALREADY CONNECTED AN ASSISTANT? ──────────────────────────────────────
+          //
+          // Folded into this route rather than given its own, because the Ask-AI control on a report
+          // already loads it and a second request per report open buys nothing.
+          //
+          // `null` IS A THIRD STATE AND THE SCREEN HAS TO DRAW IT. True, false and "no log to read" are
+          // different facts: an installation whose access log has not been written yet, or cannot be
+          // read, has not told us this reader never connected — it has told us nothing. The control
+          // treats null the way it treats false, because offering the menu to somebody with no
+          // assistant reproduces the defect this is fixing, and because the panel carries its own way
+          // past ("Already connected? Ask anyway"). What it must not do is claim the measurement.
+          aiConnected: await readerHasConnectedAi(principal),
           // Every client, already resolved: served or not, with what it needs or why it cannot be.
           //
           // ── `steps` COMES BACK, on the owner's 2026-09-03 ruling ─────────
@@ -3060,7 +3179,16 @@ async function connectorDoorKind(url) {
             const p = envFrom(process.env, "CLEAROTRON_ACCESS_FILE");
             if (p) grantsFile = { name: basename(p), modifiedAt: new Date(statSync(p).mtimeMs).toISOString() };
           } catch { /* reported as unknown; a failed stat must not take down the page that explains access */ }
-          return { status: 200, json: accessView({ grants: grantsHere, viewer: principal, companies, grantsFile, localSignIn }) };
+          // WHETHER AN ISSUED KEY CAN BE WITHDRAWN AT ALL, read the same way `disablePlan` reads it: the
+          // door loaded a revocation list at start, or it did not and never will for the keys already
+          // out. The variable's PRESENCE is the whole question — its value is a path, and this route
+          // must not say where.
+          // WHETHER A REVOCATION LIST IS NAMED FOR THIS PROCESS AT ALL — which is not the same question
+          // as whether the connector loaded one, and the page's words are careful about the difference.
+          // The connector is a separate unit with its own environment; this answers only for here.
+          const keysRevocable = Boolean(revokeConnectorKeys)
+            && String(process.env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim() !== "";
+          return { status: 200, json: accessView({ grants: grantsHere, viewer: principal, companies, grantsFile, localSignIn, keysRevocable }) };
         }
         // /portal/admin/people — give someone access. Manage-gated above; everything else is decided here.
         //
@@ -3070,23 +3198,40 @@ async function connectorDoorKind(url) {
         // as they were, and the answer says which happened. Nobody sets their own switches, and nobody
         // gives Run without holding it.
         if (parts[2] === "people" && parts.length === 3 && method === "POST") {
-          if (localSignIn) return { status: 409, json: { error: "local_sign_in" } };
+          // CODE AS ITS OWN FIELD. `error` carries a sentence on most routes here and a token on a few, so
+          // a client cannot tell the two apart by looking at it — and the one that reached the page as page
+          // copy was a token. A code the client reads as a FIELD is decidable; prose never is.
+          if (localSignIn) return { status: 409, json: { error: "local_sign_in", code: "local_sign_in" } };
           if (!writeGrants) return { status: 503, json: { error: "cannot_write_grants" } };
           const email = String(body?.email ?? "").trim().toLowerCase();
           if (!email || email.indexOf("@") <= 0 || email.indexOf("@") !== email.lastIndexOf("@"))
             return { status: 400, json: { error: "Enter one email address." } };
+          // ACCESS TO EVERYTHING IS NOT A POINT, and the handler used to treat it as one. The form draws
+          // "Everything on this Clearotron" only to somebody who holds it, and sent it as
+          // `{kind:"everything"}` alongside the organisation and company points; nothing here matched
+          // that kind, so it fell to the 404 below and the page rendered the refusal it keeps for a
+          // point outside the adder's reach — "You can only give access to what you have access to
+          // yourself" — to the one person on the install for whom that is false. The control had never
+          // worked. It lives under `people` as a switch, not in any organisation, so it is read as one.
           const points = [];
+          let wantsEverything = false;
           for (const a of Array.isArray(body?.access) ? body.access : []) {
             const key = typeof a?.key === "string" ? a.key : "";
-            if (a?.kind === "organisation" && (principal.genericOrgs ?? []).includes(key)) points.push({ tenant: key });
+            if (a?.kind === "everything" && seesEverything(principal)) wantsEverything = true;
+            else if (a?.kind === "organisation" && (principal.genericOrgs ?? []).includes(key)) points.push({ tenant: key });
             else if (a?.kind === "company" && principal.accountOrgs?.[key]) points.push({ tenant: principal.accountOrgs[key], account: key });
             else return { status: 404, json: { error: "not_found" } };
           }
-          if (!points.length) return { status: 400, json: { error: "Choose at least one organisation or company this person may see." } };
-          const want = { run: body?.permissions?.run === true, manage: body?.permissions?.manage === true };
+          if (!points.length && !wantsEverything) return { status: 400, json: { error: "Choose at least one organisation or company this person may see." } };
+          const want = { run: body?.permissions?.run === true, manage: body?.permissions?.manage === true, everything: wantsEverything };
           if (want.run && !mayRun(principal)) return { status: 400, json: { error: "You cannot give Run clearances without holding it yourself." } };
           const existing = resolvePerson(email, grantsHere);
           const setSwitches = email !== principal.email && (!existing || reachCovers(principal, existing));
+          // THE SWITCHES ARE WHERE ACCESS TO EVERYTHING IS WRITTEN, so a grant of it that cannot write
+          // them writes nothing at all — and `withPerson` would return unchanged grants and this route a
+          // 201 naming a person who gained nothing. Said instead of returned.
+          if (wantsEverything && !setSwitches)
+            return { status: 400, json: { error: "Access to everything is part of what a person may do, and that cannot be set from here for this address. Nothing was saved." } };
           let next;
           try { next = withPerson(grantsHere, { email, points, switches: want, setSwitches }); }
           catch (e) { return { status: 400, json: { error: String(e?.message ?? e).slice(0, 300) } }; }
@@ -3101,6 +3246,138 @@ async function connectorDoorKind(url) {
           const person = accessView({ grants: next, viewer: principal, companies }).people.find((p) => p.email === email) ?? null;
           return { status: 201, json: { person, switchesApplied: setSwitches } };
         }
+
+        // /portal/admin/people/change — change what somebody may do and see.
+        //
+        // THE DIFF IS COMPUTED HERE, FROM THE FILE, and never taken from the request. The page sends the
+        // state it wants; this reads what the file holds right now, narrows that to the part of the
+        // person the caller can see, and works out what to add and what to take away between the two. A
+        // page that had been open while somebody else was edited would otherwise write its own stale
+        // copy back over them — and the half it would overwrite is the half outside its own view, which
+        // nobody looking at either screen could see happen.
+        //
+        // NOBODY CHANGES THEMSELVES. The Add form already refuses to set the adder's own switches; this
+        // refuses the whole act, because a manager who can take their own Manage away can lock the
+        // install's last manager out of it with one press, and the way back is a text editor on the box.
+        if (parts[2] === "people" && parts[3] === "change" && parts.length === 4 && method === "POST") {
+          // CODE AS ITS OWN FIELD. `error` carries a sentence on most routes here and a token on a few, so
+          // a client cannot tell the two apart by looking at it — and the one that reached the page as page
+          // copy was a token. A code the client reads as a FIELD is decidable; prose never is.
+          if (localSignIn) return { status: 409, json: { error: "local_sign_in", code: "local_sign_in" } };
+          if (!writeGrants) return { status: 503, json: { error: "cannot_write_grants" } };
+          const email = String(body?.email ?? "").trim().toLowerCase();
+          if (email === principal.email) return { status: 400, json: { error: "You cannot change your own access. Somebody else who manages this install can." } };
+          const existing = resolvePerson(email, grantsHere);
+          const held = personPoints(grantsHere, email);
+          if (!existing && !held.listed && !held.points.length) return { status: 404, json: { error: "not_found" } };
+
+          // What the caller can see of this person, and what they asked for — both in the same shape, so
+          // the difference between them is the change.
+          const inReach = (pt) => pt.account == null
+            ? (principal.genericOrgs ?? []).includes(pt.tenant)
+            : principal.accountOrgs?.[pt.account] === pt.tenant;
+          const mine = held.points.filter(inReach);
+          const want = [];
+          for (const a of Array.isArray(body?.access) ? body.access : []) {
+            const key = typeof a?.key === "string" ? a.key : "";
+            if (a?.kind === "organisation" && (principal.genericOrgs ?? []).includes(key)) want.push({ tenant: key, account: null });
+            else if (a?.kind === "company" && principal.accountOrgs?.[key]) want.push({ tenant: principal.accountOrgs[key], account: key });
+            else return { status: 404, json: { error: "not_found" } };
+          }
+          const id = (pt) => `${pt.tenant}/${pt.account ?? "*"}`;
+          const wanted = new Set(want.map(id));
+          const kept = new Set(mine.map(id));
+          const drop = mine.filter((pt) => !wanted.has(id(pt)));
+          const add = want.filter((pt) => !kept.has(id(pt)));
+          // TAKING THE WHOLE OF SOMEBODY'S VISIBLE ACCESS AWAY IS REMOVAL, and it has its own route, its
+          // own confirmation and its own revocation. Reaching it by unticking every row would do half of
+          // that act under the word "save".
+          if (!want.length) return { status: 400, json: { error: "Leave them at least one organisation or company, or remove them instead." } };
+
+          const switches = { run: body?.permissions?.run === true, manage: body?.permissions?.manage === true,
+            everything: held.switches.everything };
+          if (switches.run && !held.switches.run && !mayRun(principal))
+            return { status: 400, json: { error: "You cannot give Run clearances without holding it yourself." } };
+          // Switches belong to the person and not to a point, so they are set only when the whole of this
+          // person sits inside the caller's reach. Otherwise the points move and the switches stay, and
+          // the answer says which happened — the same contract adding already has.
+          const setSwitches = reachCovers(principal, existing);
+          let next;
+          try {
+            next = drop.length ? withoutPerson(grantsHere, { email, points: drop }) : grantsHere;
+            next = withPerson(next, { email, points: add, switches, setSwitches });
+          } catch (e) { return { status: 400, json: { error: String(e?.message ?? e).slice(0, 300) } }; }
+          try { await writeGrants(next); }
+          catch (e) {
+            audit({ event: "person-change", by: principal.email, person: email, ok: false, error: String(e?.message ?? e).slice(0, 200) });
+            return { status: 500, json: { error: "The guest list could not be written, so nothing was changed." } };
+          }
+          audit({ event: "person-change", by: principal.email, person: email, added: add.length, removed: drop.length,
+            switchesApplied: setSwitches, ok: true, status: 200 });
+          const { loadProfiles } = await import("./profiles.mjs");
+          const companies = Object.fromEntries([...loadProfiles({ force: true }).values()].map((p) => [p.key, p.name ?? p.key]));
+          const person = accessView({ grants: next, viewer: principal, companies }).people.find((p) => p.email.toLowerCase() === email) ?? null;
+          return { status: 200, json: { person, switchesApplied: setSwitches, added: add.length, removed: drop.length } };
+        }
+
+        // /portal/admin/people/remove — take their access away.
+        //
+        // HOW FAR IT REACHES IS THE SERVER'S ANSWER, NOT THE REQUEST'S. A caller who can see the whole of
+        // this person removes them from the install; a caller who can see one organisation's worth of
+        // them takes away that organisation and nothing else. The page draws a different button for each
+        // — it reads the same `covered` the view computes — but the request carries no scope to get
+        // wrong, so a stale page cannot ask for more than the person pressing it can see.
+        if (parts[2] === "people" && parts[3] === "remove" && parts.length === 4 && method === "POST") {
+          // CODE AS ITS OWN FIELD. `error` carries a sentence on most routes here and a token on a few, so
+          // a client cannot tell the two apart by looking at it — and the one that reached the page as page
+          // copy was a token. A code the client reads as a FIELD is decidable; prose never is.
+          if (localSignIn) return { status: 409, json: { error: "local_sign_in", code: "local_sign_in" } };
+          if (!writeGrants) return { status: 503, json: { error: "cannot_write_grants" } };
+          const email = String(body?.email ?? "").trim().toLowerCase();
+          if (email === principal.email) return { status: 400, json: { error: "You cannot remove your own access. Somebody else who manages this install can." } };
+          const existing = resolvePerson(email, grantsHere);
+          const held = personPoints(grantsHere, email);
+          if (!existing && !held.listed && !held.points.length) return { status: 404, json: { error: "not_found" } };
+          const whole = reachCovers(principal, existing);
+          const inReach = (pt) => pt.account == null
+            ? (principal.genericOrgs ?? []).includes(pt.tenant)
+            : principal.accountOrgs?.[pt.account] === pt.tenant;
+          const mine = held.points.filter(inReach);
+          if (!whole && !mine.length) return { status: 404, json: { error: "not_found" } };
+
+          let next;
+          try { next = withoutPerson(grantsHere, whole ? { email, all: true } : { email, points: mine }); }
+          catch (e) { return { status: 400, json: { error: String(e?.message ?? e).slice(0, 300) } }; }
+
+          // THE KEYS, AND ONLY ON A WHOLE REMOVAL. A narrowing leaves the person on the install with
+          // access somewhere else, and their connector key is how they reach that.
+          let keys = { checked: false };
+          if (whole) {
+            if (!revokeConnectorKeys) keys = { checked: false, note: "this installation cannot revoke issued keys from here" };
+            else {
+              try {
+                const { grants: written, ...said } = await revokeConnectorKeys({ email, grants: next });
+                next = written ?? next;
+                keys = { checked: true, ...said };
+              }
+              // A REVOCATION THAT FAILED MUST NOT LOOK LIKE ONE THAT HAPPENED, and it must not take the
+              // removal with it either: the access record is the gate every surface reads, and leaving
+              // it in place because a key file could not be appended would be the larger failure.
+              catch (e) { keys = { checked: true, failed: true, note: String(e?.message ?? e).slice(0, 200) }; }
+            }
+          }
+
+          try { await writeGrants(next); }
+          catch (e) {
+            audit({ event: "person-remove", by: principal.email, person: email, ok: false, error: String(e?.message ?? e).slice(0, 200) });
+            return { status: 500, json: { error: "The guest list could not be written, so nothing was changed." } };
+          }
+          audit({ event: "person-remove", by: principal.email, person: email, scope: whole ? "install" : "organisations",
+            organisations: whole ? null : [...new Set(mine.map((pt) => pt.tenant))].length,
+            keysRevoked: keys.revoked ?? 0, keysUnrevokable: keys.lateArm ? (keys.jtis?.length ?? 0) : 0, ok: true, status: 200 });
+          return { status: 200, json: { removed: whole ? "install" : "organisations",
+            organisations: whole ? [] : [...new Set(mine.map((pt) => pt.tenant))], keys } };
+        }
         // /portal/admin/observed — who has actually USED this instance lately, from the audit log.
         //
         // ALWAYS 200, even when the log is missing or unreadable, with an `available` boolean — the
@@ -3761,9 +4038,39 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
   // `extra` exists so a response can carry a CSP. Before this the content-type was hardcoded and there
   // was no way to attach one — which is why the portal shipped without a policy rather than with a
   // permissive one.
+  // ── EVERY JSON RESPONSE SAYS HOW IT MAY BE CACHED, because leaving it unsaid is the defect ────────
+  //
+  // This writer used to send `content-type` and `content-length` and nothing else — no `Cache-Control`,
+  // no `Vary`, no validator — so what a browser did with a signed-in response carrying another
+  // company's material was the browser's decision and not ours. With no `Last-Modified` to work from a
+  // heuristic cache may well store nothing; the defect is not a demonstrated leak, it is that the answer
+  // was never stated for a response behind a session.
+  //
+  // THE ARGUMENT WAS ALREADY MADE HERE, FOR ONE ROUTE. `/portal/api/connect-key` has always set
+  // `no-store` because "a credential sitting in a proxy or a disk cache is the 'outlives the moment'
+  // failure ... arriving by a route the page cannot see". An access list is not a credential and has the
+  // same property, so the rule belongs to the class rather than to the one response that carried a
+  // token.
+  //
+  // `Vary: Accept` IS NOT ABOUT PRIVACY. `/portal/admin/*` is one address served two ways: the app
+  // fetches JSON there, and a browser navigation gets the app document instead (portal-static.mjs
+  // decides on `Accept`, above this router). Nothing told a cache those were different responses, so a
+  // stored JSON body could answer a later navigation and render raw data in a window — with this server
+  // never asked, which is why the negotiation above could not save it.
+  //
+  // A ROUTE'S OWN HEADERS STILL WIN. `extra` is spread last, so connect-key keeps its stricter set
+  // (`no-cache, must-revalidate, private` and the HTTP/1.0 `pragma`) rather than being flattened to this
+  // default. The arm below pins that, because a default that quietly relaxed a stricter route would be
+  // this change making things worse while reading as an improvement.
   const send = (res, status, obj, extra = {}) => {
     const b = JSON.stringify(obj);
-    res.writeHead(status, { "content-type": "application/json", "content-length": Buffer.byteLength(b), ...extra });
+    res.writeHead(status, {
+      "content-type": "application/json",
+      "content-length": Buffer.byteLength(b),
+      "cache-control": "no-store",
+      "vary": "accept",
+      ...extra,
+    });
     res.end(b);
   };
   return async function handler(req, res) {
@@ -4302,6 +4609,18 @@ const PORT = PORT_CHOICE.port;
     atomicWrite(envFrom(process.env, "CLEAROTRON_ACCESS_FILE"), `${JSON.stringify(g, null, 2)}\n`);
   };
 
+  // Revoking a removed person's connector keys, from the same module `clearotron disconnect` revokes
+  // through — one author for what revoking means, and one place the ordering rule lives: the id reaches
+  // the denylist before its record is struck, because a record removed first leaves a live key with no
+  // trace it ever existed.
+  //
+  // IT NEVER NAMES THE LIST IN `.env`. `applyDisablePlan` will do that when a plan is `lateArm` — the
+  // door was started without a revocation list, so the running process never loaded one — and that step
+  // belongs to an operator at a terminal, not to a web request rewriting the install's environment. So
+  // a lateArm plan is NOT applied: nothing is written, and the answer says the keys stay live until they
+  // expire. Striking the records instead would delete the only record of a working key.
+  const revokeConnectorKeys = makeConnectorKeyRevoker({ env: process.env });
+
   const { config } = await import("./driver.config.mjs");
   const { appendFileSync: append } = await import("node:fs");
   const auditPath = process.env.PORTAL_AUDIT || join(HERE, "..", "portal-audit.log");
@@ -4805,7 +5124,7 @@ const PORT = PORT_CHOICE.port;
   const service = makePortalService({ poolRoot: config.poolRoot, workspaceRoot: config.workspaceRoot,
     // Re-read per request (a getter that rescans), so a workspace created after boot is counted.
     queueDirs: () => config.queueDirs,
-    secret, grants, localSignIn: LOCAL_MODE, writeGrants, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
+    secret, grants, localSignIn: LOCAL_MODE, writeGrants, revokeConnectorKeys, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
     // — the ONLY place the environment is read for this. `bin/start.mjs` is the
     // only thing that sets it, and it sets it explicitly rather than passing the operator's inherited
     // environment through, so a stray `.env` can neither put a live install into demo mode nor take a

package/driver/publish/render.mjs

@@ -32,7 +32,6 @@ import { registrationSystem } from '../jurisdiction-systems.mjs';
 import { READ_LEAD_RE } from '../report-card-record.mjs';   // D3 — the dedupe gate and the card's acceptance are ONE predicate
 import { REPORT_ROOT, REPORT_ROOT_DARK_EXPLICIT, THEME_INIT_EXPLICIT, FAVICON_LINK, logoLockup, BRAND, confPosture } from '../../shared/brand.mjs';
 import { NAV_CSS } from '../../shared/site-nav.mjs';
-import { mintToken } from '../../shared/scope.mjs';   // mint a scoped read-only USER token for "Ask your AI" (dep-free; no-op fallback when no secret)
 import { isEntrypoint } from "../../shared/is-entrypoint.mjs";   // — realpath both sides, or a symlinked invocation exits 0 silently
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -1745,32 +1744,6 @@ function method(_text) {
 // lawyer signs. The slim internal toolbar that survived it existed ONLY to host the Flag/Etch
 // controls and rendered nothing without them, so took it with them.
 
-// "Ask your AI" launcher (§2.7) — its own collapsible banner under the verdict (a native <details>, default
-// collapsed, no-print). COPY-FIRST, bring-your-own-AI. Same gating as before: rendered only when a mcpUrl is
-// present (internal = shared read-only MCP; client export = OMITTED unless a scoped mcpUrl is given).
-function askAi(fm, { mcpUrl, runId }) {
-  const mark = String(fm.title || fm.matter || 'this mark').trim();
-  const prompt = runId ? `Brief me on trademark clearance run ${runId}.` : `Brief me on the ${mark} trademark clearance.`;
-  const pa = escAttr(prompt);
-  const steps = (label, items) => `<details class="askai-steps"><summary>${label}</summary><ol>${items.map(i => `<li>${i}</li>`).join('')}</ol></details>`;
-  return `<details class="askband no-print">
-    <summary>
-      <div class="askband-ic" aria-hidden="true">💬</div>
-      <div class="askband-main">
-        <div class="askband-title">Ask your AI about this run <span class="askband-exp" aria-hidden="true">▾</span></div>
-        <div class="askband-sub">Connect once and interrogate the findings in the Claude or ChatGPT you already use — read-only.</div>
-      </div>
-    </summary>
-    <div class="askband-body">
-      <button type="button" class="util primary askai-copy" data-copy="${pa}">📋 Copy question</button>
-      <p class="askai-hint">Paste into the Claude or ChatGPT you already use — read-only. New chat: <a href="https://claude.ai/new" target="_blank" rel="noopener">Claude →</a> · <a href="https://chatgpt.com/" target="_blank" rel="noopener">ChatGPT →</a></p>
-      <div class="askai-field"><code class="askai-url">${esc(mcpUrl)}</code><button type="button" class="util askai-copy" data-copy="${escAttr(mcpUrl)}">Copy</button></div>
-      ${steps('Set up Claude <span class="askai-checked">· ✓ Checked 4 September 2026</span>', ['Settings → Connectors → Add custom connector', 'Paste the address above — it already carries your key', 'Set Authentication to None', 'Add. If it warns that authentication is required, that is its own guess — None is correct here'])}
-      ${steps('Set up ChatGPT', ['Settings → Connectors → Advanced → Developer mode', 'Add MCP server, paste the address above', `Sign in when the browser opens (${BRAND.name} email)`])}
-      <p class="askai-hint askai-note">These steps name no button we have not opened ourselves. Your app may word them differently.</p>
-    </div>
-  </details>`;
-}
 
 // Brand :root tokens are sourced from shared/brand.mjs (REPORT_ROOT) and prepended to the
 // report stylesheet, so report.css carries only rules — the palette lives in ONE place across surfaces.
@@ -1808,7 +1781,6 @@ window.addEventListener('hashchange',_cardHashGo);
 window.addEventListener('load',_cardHashGo);
 window.addEventListener('beforeprint',function(){document.querySelectorAll('details').forEach(function(d){d.dataset.o=d.open?'1':'';d.open=true;});});
 window.addEventListener('afterprint',function(){document.querySelectorAll('details').forEach(function(d){d.open=d.dataset.o==='1';});_hidden.forEach(function(c){c.classList.remove('print-hidden');});_hidden=[];});
-document.addEventListener('click',function(e){var cp=e.target.closest('.askai-copy');if(cp){navigator.clipboard&&navigator.clipboard.writeText(cp.getAttribute('data-copy'));}});
 document.addEventListener('click',function(e){var t=e.target.closest('.tb-exp-toggle'),pop=document.querySelector('.tb-exp-pop');if(t){if(pop){pop.hidden=!pop.hidden;t.setAttribute('aria-expanded',String(!pop.hidden));}return;}if(pop&&!pop.hidden&&!e.target.closest('.tb-exp-pop')){pop.hidden=true;var b=document.querySelector('.tb-exp-toggle');if(b)b.setAttribute('aria-expanded','false');}});
 document.addEventListener('keydown',function(e){if(e.key==='Escape'){var pop=document.querySelector('.tb-exp-pop');if(pop&&!pop.hidden){pop.hidden=true;var b=document.querySelector('.tb-exp-toggle');if(b)b.setAttribute('aria-expanded','false');}}});`;
 
@@ -2154,21 +2126,6 @@ export function renderHtml(parsed, findings = [], coverage = [], opts = {}) {
 
   // Excel/audit download — lives inside the topbar Export popover (portal-report strips the link at serve time for non-staff).
   const excelBtn2 = !opts.auditFile ? '' : `<a class="util" href="${esc(opts.auditFile)}" download>⬇ Download full audit (Excel)</a>`;
-  // "Ask your AI" target. Explicit opts.mcpUrl wins. Otherwise the staff surface (CLEAROTRON_MCP_URL), with
-  // a run-scoped read-only token embedded when a secret is configured. ONE report: the document always
-  // carries the staff connector; portal-report.mjs strips the whole block (and redacts any surviving MCP
-  // host) for non-staff readers at serve time — the client's connector path is the portal's own
-  // /portal/api/mcp-access, which needs no baked credential. FAIL CLOSED on a missing env: NO placeholder
-  // host — a forgotten env used to render a mcp.example.com connector that looked configured and resolved
-  // nowhere.
-  let mcpUrl = opts.mcpUrl || '';
-  if (!mcpUrl) {
-    const base = process.env.CLEAROTRON_MCP_URL || '';
-    let tok = '';
-    if (base && opts.runId) { try { tok = mintToken({ scope: 'user', runId: opts.runId }); } catch { tok = ''; } }
-    mcpUrl = base ? (tok ? `${base}?token=${tok}` : base) : '';
-  }
-  const askAiHtml = mcpUrl ? askAi(fm, { mcpUrl, runId: opts.runId }) : '';
 
   const cardFor = f => matchCard(f, cards);
   const recordsByUri = opts.recordsByUri || new Map();   // Instance #6 — the run's _records/ set (publishReport loads it)
@@ -2372,8 +2329,6 @@ ${opts.nav || ''}
     findings.some((f) => (f?.owner?.registrations ?? []).some((r) => r?.uri
       && (recordsByUri.size > 0 || !(r.status || r.filed || r.expiry || (r.classes && r.classes.length))))))}
 
-  ${askAiHtml}
-
   <footer>
     <span>${productName ? `${esc(productName)}. ` : ''}${FRAMEWORK
         // TWO SENTENCES, and that count is the ruled shape rather than a consequence of trimming.

package/driver/publish/templates/report.css

@@ -214,22 +214,6 @@
   details.method[open]>summary::after{content:"▴"}
   .method .mbody{padding:0 22px 20px;font-size:13px;color:var(--slate);line-height:1.62}
 
-  /* Ask-your-AI launcher */
-  .askai{position:relative;display:inline-block}
-  .askai-pop{position:absolute;z-index:30;top:calc(100% + 8px);left:0;width:340px;max-width:88vw;background:var(--card);
-    border:1px solid var(--line2);border-radius:14px;box-shadow:var(--shadow);padding:14px}
-  .askai-hint{font-size:11.5px;color:var(--slate);margin:9px 0 8px;line-height:1.45}
-  .askai-field{display:flex;gap:6px;align-items:center;background:var(--bg2);border-radius:9px;padding:6px 8px;margin-bottom:8px}
-  .askai-url{font-family:var(--mono);font-size:11px;flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
-  .askai-steps>summary{cursor:pointer;font-size:11.5px;font-weight:700;color:var(--crimson);padding:4px 0;list-style:none}
-  .askai-steps>summary::-webkit-details-marker{display:none}
-  .askai-steps ol{margin:4px 0 8px;padding-left:18px;font-size:11.5px;color:var(--slate)}
-  /* The dated stamp on a set-up recipe we have actually driven. Muted on purpose: the recipe's own
-     summary is crimson and bold, and a stamp that shouted as loudly would read as part of the step. */
-  .askai-steps>summary .askai-checked{font-weight:600;color:var(--slate)}
-  /* The note under BOTH recipes. `.askband-body .askai-hint` zeroes the top margin for the hint that
-     opens the body; this one closes it and needs the gap back. */
-  details.askband .askband-body .askai-note{margin-top:10px}
 
   footer{margin-top:54px;padding-top:20px;border-top:2px solid var(--ink);font-size:12px;color:var(--faint);line-height:1.6;display:flex;justify-content:space-between;gap:20px;flex-wrap:wrap}
   footer .wm{font-size:13px}
@@ -282,19 +266,6 @@
   .rv-tag{font-size:9px;font-weight:700;letter-spacing:.1em;text-transform:uppercase;color:#a06aa3}
   .rv-spacer{flex:1;min-width:16px}
 
-  /* Ask-AI banner (collapsible) */
-  details.askband{display:block;background:var(--card);border:1px solid var(--line);border-left:4px solid var(--crimson);border-radius:14px;padding:16px 18px;margin:20px 0 0;box-shadow:var(--shadow)}
-  details.askband>summary{cursor:pointer;list-style:none;display:flex;gap:14px;align-items:flex-start}
-  details.askband>summary::-webkit-details-marker{display:none}
-  .askband-ic{flex:none;width:38px;height:38px;border-radius:11px;background:var(--high-soft);color:var(--high-tx);display:flex;align-items:center;justify-content:center;font-size:18px}
-  .askband-main{flex:1;min-width:0}
-  .askband-title{font-weight:900;font-size:16px;letter-spacing:-.01em;margin:0 0 3px}
-  .askband-sub{font-size:13px;color:var(--slate);line-height:1.5;margin:0}
-  .askband-exp{display:inline-block;transition:.15s;color:var(--faint);font-size:12px;margin-left:4px}
-  details.askband[open] .askband-exp{transform:rotate(180deg)}
-  details.askband .askband-body{margin-top:12px;padding-left:52px;max-width:560px}
-  details.askband .askband-body .askai-hint{margin-top:0}
-  @media(max-width:560px){details.askband .askband-body{padding-left:0}}
 
   /* cross-region rights-holder rows (.rrow) + secondary region groups (.rgroup) */
   .keypanel{overflow-y:auto}
@@ -334,7 +305,7 @@
   @media (min-width:760px){.rn-why{flex:1 1 46%;min-width:280px}}
 
   @media print{
-    .topbar,.no-print,.review,.askband,.int-note{display:none!important}
+    .topbar,.no-print,.review,.int-note{display:none!important}
     body{background:#fff}
     .panel,.card,.land,.firstUp,.method{box-shadow:none}
     /* Only PURE TOGGLES hide their summary line in print — the drill toggles ("The read" / "Full detail

package/driver/skills/knockout-assess/SKILL.md

@@ -16,7 +16,8 @@ there is no other value: a band that needs sharpening is the band above it, stat
 ## Per mark — the mandatory sequence
 
 1. **Context framing FIRST** (from the plan; correct it only if plainly wrong): coined vs common
-   phrase vs cultural echo — the rating hangs off this.
+   phrase vs cultural echo. It frames what the name READS as, and the evidence bullets draw on it.
+   The band does not: no framing raises or lowers a rating (calibration rule 3, retired).
 2. **Parody / evocation check**: does the name echo a famous mark or property even without identical
    ownership ("Free Range 1s" echoes "Air Force 1s")? Flag it even when nobody owns the echoed form.
 3. **Band per the framework ladder**, applying the calibration rules below.
@@ -58,11 +59,21 @@ there is no other value: a band that needs sharpening is the band above it, stat
    read." It was the only instruction in this seat's context licensing that move, and the readiest
    explanation for a Disney hit rating Very High and an EA hit rating High against a lawyer's Medium and
    Manageable. The rest of the rule stands and is doctrine.)*
-3. **Never rate the lowest band for common English phrases — DO rate it for coined/fanciful terms.**
-   Common word or phrase → second-lowest band minimum even on a clean sweep, plus the purple
-   register-pending note. Coined/invented word with a clean sweep → the lowest band is correct.
-   The test: could a reasonable person use this word in everyday speech without reference to the
-   proposed mark? No → coined. Yes → common phrase → floor applies.
+3. **RETIRED — how ordinary the words are is a note for the reviewing lawyer, never a band.**
+   This forbade the lowest band for a common English phrase and put a floor a band above it. On a
+   scale that ends in Low it kept an everyday name off "no issues found"; on a client scale with no
+   Low band the floor landed one band higher still, and three names went out rated above every
+   conflict card on their own pages — twelve cards, all at the bottom band, under three names a band
+   above them, with nothing on the page to explain it. The reviewing lawyer rated the cards right and
+   the names wrong.
+   **Removed for every client, not only where it misfired** (owner, 2026-09-15). Keeping it on scales
+   that have a Low band was considered and rejected; so was explaining the gap on the report, because
+   a report that explains a wrong rating is still wrong.
+   Say what the words are in the reading — coined, compound, everyday phrase, cultural echo — and let
+   it inform the evidence bullets. It does not set, floor or lift a band. A risk that belongs to the
+   NAME rather than to one user is written as its own `findings[]` record and rated there; Famous
+   Brand and Cultural Reference are already card types for exactly that.
+   *The number is kept and not reused*, for the reason rule 4 gives below.
 4. **RETIRED — the caveat is conditional now, and it is not this file's to state.**
    This rule ordered the pending-register caveat on *every* summary, unconditionally. When the register
    ran and surfaced live filings, that sentence tells a client its ratings are common-law only while the
@@ -77,6 +88,24 @@ there is no other value: a band that needs sharpening is the band above it, stat
    at its "(low)" qualifier.
 7. **Client's prior use mitigates, doesn't eliminate.** Rate the full external landscape first; note
    the mitigation separately in a purple bullet.
+8. **A NAME IS NEVER RATED ABOVE THE WORST CARD ON ITS PAGE.** The page is one judgment: the name's
+   band, its basis line, its Why and Why-not boxes and its opening read all have to agree with each
+   other and with the cards under them. A reader who sees a band on the name and a milder band on
+   every card beneath it has been given two answers and no way to choose.
+   **Cards means every rated item on this name's page** — each `findings[]` record, and each
+   `registerReads[]` row that carries a band. A row with no band is not a card and does not count.
+   **A name with no rated cards takes the bottom band of the client's own ladder.** Nothing was found
+   against it; that is what the bottom band is for. It is not a reason to reach up a band.
+   **Rating BELOW the worst card is allowed and needs a sentence**, because it is a real judgment:
+   the worst card's holder may touch only the edge of the request. Say which card and why it does not
+   carry the name.
+   **Anything that should lift a name is a card of its own** — a famous-mark echo, a cultural
+   reading, a risk that belongs to the NAME rather than to one user. Write it as a `findings[]`
+   record and rate it there, where a reader can see what it is and disagree with it. A band lifted
+   without a card is a conclusion with its evidence left out.
+   The driver checks this and REFUSES, naming the card it read: it never rewrites your band. A
+   corrected band you reasoned is the product; a band a script lowered under prose that still argues
+   for the old one is worse than the defect it replaced.
 
 ## Degraded marks (research unavailable or null — never inflate)