clearotron 0.3.2-beta.4 → 0.3.2-beta.5

package/INSTALL.md

@@ -331,6 +331,7 @@ terminal and is rewritten on every start.
 ~/trademark/config/profiles                   the company profiles
 ~/trademark/grants.json                       who may use this install
 ~/trademark/portal-audit.log                  what the portal was asked to do
+~/trademark/telemetry/trademark-mcp-access.jsonl   what a connected assistant asked for, and what it was told
 ~/trademark/portal-local-credential.json      the sign-in this install minted for you
 ```
 

package/bin/onboard.mjs

@@ -2702,6 +2702,71 @@ export async function runCheck() {
         + `Run \`${invoke("start")}\` — it creates the list.`);
     }
   }
+  // ── IS THIS DOOR'S ACCESS LOG BEING WRITTEN, AND WHERE? ───────────────────────────────────────────
+  //
+  // A client's assistant can list runs, read reports and pull artifacts through this door. The record of
+  // what a key did is the only way to answer a client, a lawyer or an incident review afterwards, and a
+  // log nobody can find is a log nobody checks.
+  //
+  // THE OVERRIDE IS READ FROM THE UNIT, NOT FROM THIS PROCESS. `TRADEMARK_MCP_AUDIT_LOG` decides where
+  // the writer appends, and the writer is the service — so this command's own environment is not the
+  // answer and using it would produce a confident report about a file the door never touches. Where the
+  // two disagree, that disagreement is the finding and is said out loud rather than resolved silently.
+  //
+  // WITH NO OVERRIDE THERE ARE TWO CANDIDATES, and which one the writer picked depends on what existed
+  // when IT started — a legacy path is kept if it is already there, so that a compliance trail is not
+  // split in two by a moved default. `auditPaths()` is the module's own reader for exactly this and is
+  // called rather than re-derived; re-deriving that branch here is the defect its source warns about.
+  try {
+    const { auditPaths: auditCandidates } = await import(pathToFileURL(join(REPO, "mcp-server", "lib", "audit.mjs")).href);
+    const seen = hosted ? unitValue(unitEnv, "TRADEMARK_MCP_AUDIT_LOG") : { state: "unset", value: null };
+    if (seen.state === "unknown") {
+      info(couldNotDetermine("TRADEMARK_MCP_AUDIT_LOG", unitEnv) + " The access log's location cannot be named.");
+    } else {
+      const mine = String(process.env.TRADEMARK_MCP_AUDIT_LOG ?? "").trim();
+      if (seen.state === "unset" && mine) {
+        warn(`this shell sets TRADEMARK_MCP_AUDIT_LOG and the units do not, so the door is NOT writing where `
+          + `this command would look. The door's log is at its default; ${mine} is this shell's answer only.`);
+      }
+      const paths = seen.state === "set" ? [seen.value] : auditCandidates();
+      let wrote = null;
+      for (const p of paths) {
+        try { const s = statSync(p); if (s.size > 0) { wrote = p; break; } } catch { /* not this one */ }
+      }
+      if (wrote) {
+        ok(`the client door's access log is being written: ${wrote}`);
+      } else {
+        // NOT-YET-WRITTEN IS NOT UNWRITABLE. A door nobody has called through has no log, and saying it
+        // is broken would be the same lie as calling an unreachable unit inactive.
+        //
+        // NAME THE ONE THE WRITER WOULD PICK, WHICH IS NOT SIMPLY THE FIRST. With no override there are
+        // two candidates and the older is kept only when it is ALREADY THERE, so that a compliance trail
+        // is not split by a moved default. Naming the older one unconditionally would print the
+        // integrator platform's folder at setup on installs that have no such file — a folder this engine
+        // does not require and whose mention was deliberately removed from this command. Where it does
+        // exist it IS the log and is named, because that is then the true answer.
+        const existing = paths.find((c) => { try { statSync(c); return true; } catch { return false; } });
+        const willUse = existing ?? paths[paths.length - 1];
+        const dir = dirname(willUse);
+        let writable = null;
+        try { accessSync(dir, constants.W_OK); writable = true; } catch (e) { writable = e?.code === "ENOENT" ? null : false; }
+        if (writable === false) {
+          blocking(`the client door's access log cannot be written: ${dir} is not writable by this user. `
+            + "Every call through this door would go unrecorded, and an absent record reads as nothing happened.");
+        } else if (writable === null) {
+          info(`no access log yet at ${willUse} and its directory does not exist — the door creates it on the `
+            + "first call. Nothing has come through it, or nothing has since the path last changed.");
+        } else {
+          info(`no access log yet at ${willUse}, and its directory is writable — nothing has come through `
+            + "this door yet. The first call creates it.");
+        }
+      }
+    }
+  } catch (e) {
+    info(`could not check the client door's access log (${e?.code ?? e?.message ?? e}) — this is a report `
+      + "that this command could not look, not that the log is missing.");
+  }
+
   try {
     const { clientDoorState: doorState, describeDoorState, connectKeyReport, CLIENT_DOOR_UNIT: doorUnit } = await import(pathToFileURL(join(REPO, "shared", "client-door.mjs")).href);
     const { loadGrants: readGrantsFile, isRevoked: revokedCheck } = await import(pathToFileURL(join(REPO, "shared", "scope.mjs")).href);

package/bin/start.mjs

@@ -449,6 +449,10 @@ export function installPaths(base) {
     locks: join(base, "locks"),
     grants: join(base, "grants.json"),
     audit: join(base, "portal-audit.log"),
+    // The connector doors' access log — the record of what a client key did, which is what answers a
+    // client or a review afterwards. NAMED IN THE LAYOUT rather than built at the call site, for the
+    // reason the store below gives: a demo's isolation must be a property of where things live.
+    accessLog: join(base, "telemetry", "trademark-mcp-access.jsonl"),
     // The saved-search store is a git repository because recipe-service commits every save through
     // `git add` + `git commit` — that is the product's config-store model, not something invented here.
     // It is its own directory, NOT `base`, so the commit path never sees the pool, the queue or the
@@ -680,6 +684,16 @@ export function childEnv({ ports, paths, user, portalSecret, tokenSecret, opsTok
       "PROFILE_AUDIT": "",
       "RECIPE_AUDIT": "",
       "CLEAROTRON_FEEDBACK_DIR": "",
+      // AN EXPLICIT PATH, NOT "" LIKE THE TWO ABOVE. Empty is unset, and unset is what sends this one to
+      // the REAL install's home: its default is computed from `homedir()`, not from any directory a demo
+      // controls. So a demo left to fall back writes its access lines into the install beside it, and the
+      // demo stops being one directory a reader can delete. Measured as exactly that: a demo run left
+      // `telemetry/trademark-mcp-access.jsonl` in the install it booted next to.
+      //
+      // ONLY IN A DEMO. A real install must NOT have this pinned: with no override the writer keeps an
+      // older log where one already exists, so that moving the default does not split a compliance trail
+      // in two. Pinning the name here would override that and do the splitting.
+      "TRADEMARK_MCP_AUDIT_LOG": paths.accessLog,
     } : {}),
   });
   return {

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "9bb3ab371e736a3b4a80f2d6dbdd71fd719b173e",
-  "version": "0.3.2-beta.4"
+  "commit": "ed09608753479ab7824e8f5f7dc256c12ca0bc07",
+  "version": "0.3.2-beta.5"
 }

package/demo/knockout-search/run/_driver/predelivery-lint.json

@@ -1,5 +1,5 @@
 {
-  "ts": "2026-09-04T21:48:51.264Z",
+  "ts": "2026-09-16T16:48:57.832Z",
   "lane": "knockout",
   "checks": [
     {
@@ -43,9 +43,33 @@
       "surface": "findings",
       "pass": true,
       "detail": ""
+    },
+    {
+      "id": "reviewer-note-subject",
+      "family": "voice",
+      "surface": "findings",
+      "pass": true,
+      "detail": ""
+    },
+    {
+      "id": "plain-language-vocabulary",
+      "family": "voice",
+      "surface": "findings",
+      "pass": false,
+      "detail": "the lawyer's vocabulary on lines a reader meets before opening anything — rewrite the sentence in the words the reader already owns, do not swap the word: the batch summary: \"belt-and-braces\" → \"extra\"; the batch summary: \"chunk\" (an engine word — cut it)"
+    },
+    {
+      "id": "plain-language-sentence-length",
+      "family": "voice",
+      "surface": "findings",
+      "pass": false,
+      "detail": "a default-visible sentence carrying more than one idea (over 25 words) — split it, conclusion first: the batch summary: 28 words; the batch summary: 28 words; the batch summary: 27 words; the batch summary: 39 words; the batch summary: 26 words; +4 more"
     }
   ],
-  "failures": [],
+  "failures": [
+    "plain-language-vocabulary",
+    "plain-language-sentence-length"
+  ],
   "notApplicable": [
     {
       "id": "names-cell-populated",

package/driver/CHANGELOG.md

@@ -1,5 +1,11 @@
 # clearotron-driver
 
+## 0.3.2-beta.5
+
+### Patch Changes
+
+- a4ea94d: For operators: The connector access log now records what happened to each call, and records calls that were refused as well as calls that got through. A line also names which door took the call, so a client key and a staff session can be told apart. Before, a call was recorded only as having been made, and a refused one left no line at all. `doctor` now names where that log is being written. It reads that from the service's own settings, not from the shell you are typing in.
+
 ## 0.3.2-beta.4
 
 ### Patch Changes

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.4",
+  "version": "0.3.2-beta.5",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline.mjs

@@ -6437,8 +6437,10 @@ function injectFrontMatter(path, fields, runDir = null) {
 // spec 62 — the per-field CONFIGURATION PROVENANCE rows for a project run: for each PROJECT_KEY, its effective
 // value (compact) and where it came from (project | customer | house). Read off the frozen sidecar `pr` (both
 // origins and the effective values live there), serialised to a single-line JSON string for the report
-// front-matter, and rendered INTERNAL-ONLY in the scope fold (never on the client export — provenance, not
-// process-exhaust). Absent origins ⇒ [] ⇒ nothing injected (no-project runs are untouched).
+// front-matter. It was rendered internal-only in the scope fold; the 2026-09-16 redesign takes that fold
+// off the page, and this row set went with it — it was the one block in there labelled internal, which is
+// the class that ruling removed. IT IS STILL RECORDED, here and in the workbook, which is where a reader
+// who wants to know which layer set a knob now finds out. Absent origins ⇒ [] ⇒ nothing injected.
 function originRowsForReport(pr) {
   if (!pr?.origins) return [];
   const short = (s, n = 48) => { const t = String(s ?? "").trim(); return t.length > n ? `${t.slice(0, n - 1)}…` : t; };