clearotron 0.3.3 → 0.4.0-beta.0

package/INSTALL.md

@@ -647,24 +647,11 @@ matches, the neutral Generic default applies.
   config store and the engine loads *those* companies instead. **Same engine, different config path** —
   the code carries no company identities.
 
-  Two things go with it, and both are refusals rather than preferences:
+  One thing goes with it, and it is a refusal rather than a preference:
 
   - **`PROFILE_REPO_ROOT` moves too.** The company directory has to sit inside the repository that
     variable names, because editing a profile is a commit. Point one somewhere new and leave the other
     behind and the portal and the profile service both refuse to start, naming both variables.
-  - **That repository needs a `user.name` and a `user.email` of its own.** Saves are committed under
-    the name of whoever asked for them, but git also records who *made* the commit, and it will not
-    commit at all without one. A service account usually has no global git identity, so a store created
-    by hand needs its own:
-
-    ```bash
-    git init -b main /srv/clearotron-store
-    git -C /srv/clearotron-store config user.name  "clearotron local install"
-    git -C /srv/clearotron-store config user.email "clearotron@example.com"
-    ```
-
-    `clearotron start` does this for the store it creates. A store you make yourself does not get it,
-    and the symptom is the first save failing at a commit rather than anything about profiles.
 - **Run data is external too.** Published reports, audits, and per-run state go to the archive pool at
   `CLEAROTRON_REPORTS_DIR`. Nothing company-specific is committed to the repository.
 

package/bin/brandowner.mjs

@@ -160,11 +160,10 @@ export async function add(argv, {
     contextPack = readFileSync(packFile, "utf8");
   }
 
-  // THE ROSTER IS READ BEFORE THE CANDIDATE IS BUILT, because the Generic default lives in it. The
-  // candidate is still judged as a member of the roster and not alone — see assertRosterAccepts.
+  // The candidate is judged as a member of the roster and not alone — see assertRosterAccepts.
   const { loadProfiles } = await import("../driver/profiles.mjs");
   const load = loadProfilesFn ?? loadProfiles;
-  const platforms = resolvePlatforms(args.platforms, rosterAsItStands(store, load));
+  const platforms = resolvePlatforms(args.platforms);
 
   const profile = buildProfile({
     key: args.key, name: args.name.trim(), domains: args.domains,
@@ -180,10 +179,11 @@ export async function add(argv, {
     : `framework: ${framework.path} — THE GENERIC DEFAULT, applied because none was supplied. `
       + `Their matters will be rated under it until they give us theirs.`;
 
+  // NONE, when none was supplied (the owner's ruling of 2026-09-23): the brand owner starts with no
+  // marketplaces, and the line says what their searches still cover.
   const platformsLine = platforms.source === "supplied"
     ? `platforms: ${platforms.platforms.join(", ")} — as supplied`
-    : `platforms: ${platforms.platforms.join(", ")} — THE GENERIC DEFAULT, applied because none was supplied. `
-      + `Their searches cover these marketplaces until someone changes them in the portal.`;
+    : `platforms: none — searches use the general web, plus any stores chosen for each matter.`;
 
   if (args.dryRun) {
     out(`would create ${join(store, `${args.key}.json`)}`);

package/bin/connect.mjs

@@ -135,10 +135,10 @@ export function systemdFailure(e, { step, unit = null } = {}) {
 const UNIT_DIR = join(homedir(), ".config", "systemd", "user");
 const ENV_PATH = join(homedir(), ".env");
 // Where the revocation list lives when this install has never named one — created by connect so the
-// door is BORN consulting it (; measured: no denylist is configured on production,
-// and `isRevoked()` returns false on an UNSET path — still true, and deliberately so: a deployment that
-// never asked for a denylist is not taken down by one. It is an unreadable list that now refuses
-//. Assuming a path nobody set still makes every issued key unrevokable).
+// door is BORN consulting it (; measured: no denylist is configured on production).
+// `isRevoked()` now reads this same default when the setting is unset, and an absent default reads as
+// "nothing revoked"; a list that is there and unreadable refuses. Naming the path is still what makes
+// every door, whatever home it runs under, read the file a revocation is written to.
 // — one owner for this path. It was written out here, in disconnect and twice
 // in start; `start` named it and created nothing, which is how a revoked key kept answering 200.
 const DENYLIST_PATH = defaultDenylistPath(homedir());

package/bin/onboard.mjs

@@ -3453,10 +3453,8 @@ export async function runCheck() {
       if (r.state === "valid") ok(line);
       else info(line);
     }
-    if (report.valid && !String(process.env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim()) {
-      problem("a valid key is on record but NO revocation list is configured (TRADEMARK_MCP_TOKEN_DENYLIST unset) "
-        + `— \`${invoke("disconnect")}\` could not actually revoke it. \`${invoke("connect")}\` arms one; set the variable or reconnect.`);
-    }
+    // No "revocation list not configured" problem any more: with TRADEMARK_MCP_TOKEN_DENYLIST unset, every
+    // door reads the install's default list (isRevoked, shared/scope.mjs), which is where disconnect writes.
     // THE PUBLISHED ADDRESS, AND WHETHER IT ANSWERS (acceptance 2). Reported here
     // rather than beside the unit, because the unit running and the address being reachable are
     // different facts and the second is the one a client depends on.
@@ -4496,9 +4494,9 @@ try {
   candidate.PROFILE_REPO_ROOT = cfg;   // no alias row — this name is current
   for (const k of ["CLEAROTRON_CUSTOMERS_DIR", "PROFILE_REPO_ROOT"]) ok(`${k}=${candidate[k]}`);
   // A REPOSITORY ALREADY THERE IS ASKED NOW, while the operator is still here, whether it can record a
-  // save. `clearotron start` gives a store it creates an identity of its own; one made by hand has none
-  // unless somebody set it, and on a machine with no global identity the first company created in the
-  // portal is refused. Said here, with the command, rather than discovered on that first company.
+  // save: one this account cannot use refuses the first company created in the portal. Said here, with
+  // the command, rather than discovered on that first company. A missing git identity is not asked
+  // about, because every save supplies the product's own committer.
   if (existsSync(join(cfgAbs, ".git"))) {
     const cannot = storeCommitRefusal(cfgAbs);
     if (cannot) warn(`${cannot.message}. Until then, creating a company in the portal is refused.`);

package/bin/start.mjs

@@ -111,7 +111,7 @@ export async function runTables() {
   return { registers: PROVIDERS, engines: ENGINE_BINARIES, defaultEngine: RUN_DEFAULT_ENGINE, resolveEngine: resolveEngineProgram };
 }
 import { spawn, spawnSync, execFileSync } from "node:child_process";
-import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal } from "../shared/store-in-repo.mjs";   //
+import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal, storeCommitEnv } from "../shared/store-in-repo.mjs";   //
 import { stdioConnectOffer } from "../shared/stdio-connect.mjs";
 import { wslTarget } from "../shared/wsl.mjs";   // — and which distribution a row should start the server in
 import { ensureDemoProgram } from "../shared/permanent-install.mjs";   // — a demo from npx keeps its own copy
@@ -1531,9 +1531,9 @@ if (isMain) {
       err(`  WARNING: could not initialise the saved-search store at ${paths.configStore} (${String(e?.message ?? e)}). Searches will list and run; SAVING one will fail until this is a git repository.`);
     }
   } else {
-    // AN ADOPTED STORE IS ASKED WHETHER IT CAN RECORD A SAVE, HERE, not at the first save. A repository
-    // made by hand has no identity unless somebody gave it one, and on a machine with no global identity
-    // the first company created in the portal is then refused. The one created above sets its own.
+    // AN ADOPTED STORE IS ASKED WHETHER IT CAN RECORD A SAVE, HERE, not at the first save: a directory
+    // that is not a repository this account can use refuses every company created in the portal. A store
+    // with no git identity is not refused; every save supplies the product's own committer.
     const cannot = storeCommitRefusal(paths.configStore);
     if (cannot) err(`  WARNING: ${cannot.message}. Until then, creating a company or saving a search is refused.`);
   }
@@ -1556,7 +1556,7 @@ if (isMain) {
         // and the first save commits them with its own change.
         try {
           execFileSync("git", ["-C", paths.configStore, "add", "-A", "--", "profiles"], { stdio: "ignore" });
-          execFileSync("git", ["-C", paths.configStore, "commit", "-q", "-m", "the demo's company"], { stdio: "ignore" });
+          execFileSync("git", ["-C", paths.configStore, "commit", "-q", "-m", "the demo's company"], { stdio: "ignore", env: storeCommitEnv(paths.configStore) });
         } catch { /* see above */ }
         say(`  demo store     ${paths.profiles} — ${copied.join(", ")}`);
       }
@@ -2298,6 +2298,7 @@ if (isMain) {
   // the `stopping` flag is what stops an orderly stop being reported as a crash.
   process.on("SIGINT", () => { void shutdown(0); });
   process.on("SIGTERM", () => { void shutdown(0); });
+  for (const sig of windowCloseSignals()) process.on(sig, () => { void shutdown(0); });
 
   const healthy = async (url, rec) => {
     const deadline = Date.now() + 30_000;
@@ -2678,6 +2679,20 @@ export function backgroundOfferLines({ demo = false, keep = false, manager = nul
   ];
 }
 
+/**
+ * The signal that means the window was closed, which a foreground start treats as a stop.
+ *
+ * SIGHUP, on every platform. Closing a terminal sends it, and with no handler Node's default ended this
+ * process on the spot: the teardown never ran, and the children, which lead sessions of their own, never
+ * received the hangup. The portal, the door and the worker went on running with nothing supervising them
+ * and a search in flight carried on (measured on Linux, 2026-09-23), while the banner above says closing
+ * the window stops everything this command started. Windows reports closing the console window as SIGHUP
+ * too.
+ */
+export function windowCloseSignals() {
+  return ["SIGHUP"];
+}
+
 /**
  * What a reader is told when a child this install cannot run without exits.
  *

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "80f14b0925b8052cb70d5173a6f664bd2a2510a0",
-  "version": "0.3.3"
+  "commit": "1b114acfd84b91de944063c0f16a99d16652adce",
+  "version": "0.4.0-beta.0"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,23 @@
 # clearotron-driver
 
+## 0.4.0-beta.0
+
+### Minor Changes
+
+- Before you upgrade: a new operator key must now name the tools it may use, for example `--verbs start_run,stop_run`. Keys already issued keep working.
+  
+  For operators: a revoked key stops working even where no revocation list was set up, because every connector now reads the install's own list.
+  
+  Fixed: over the network, an operator key can no longer start a what-if that its assistant is not shown.
+  
+  Fixed: the portal refuses a change sent from another website, or from another app on the same computer, including a sign-in.
+
+### Patch Changes
+
+- Fixed: closing the window that runs `clearotron start` now stops Clearotron. Before, it kept running in the background.
+- Fixed: Creating a company in the portal no longer stops with a request to run a git command.
+- Fixed: A new company starts with no marketplaces. The company page offers the usual ones to add, and a company with none is still searched on the general web.
+
 ## 0.3.3
 
 ### Patch Changes

package/driver/company-bundle.mjs

@@ -99,28 +99,21 @@ export function resolveFramework(requested, {
 
 // ── the profile this writes ────────────────────────────────────────────────────────────────────────
 /**
- * Which marketplaces this brand owner's searches cover — supplied, or the Generic default, SAID OUT LOUD.
+ * Which marketplaces this brand owner's searches cover: the ones supplied, or NONE.
  *
- * A customer bundle is a COMPLETE document in this design, not an overlay on generic: every shipped
- * profile carries its own `platforms`, and the loader requires a non-empty array on every file. The
- * command had no way to supply one and set none, so every bundle it wrote failed to load on this field
- * as well as on the `key` field above — two independent invalidities, and onboarding could not produce
- * a loadable brand owner at all.
+ * A customer bundle is a COMPLETE document in this design, not an overlay on generic: every profile
+ * carries its own `platforms` array, and the loader requires one on every file.
  *
- * Defaulting rather than refusing, and naming it, is this command's own established idiom: the same
- * ruling governs the framework one function down. Which marketplaces a client's clearance searches is
- * not a detail to decide silently, so an operator who supplies nothing is TOLD what they got and can
- * refine it in the portal.
+ * NONE, NOT THE GENERIC DEFAULT, by the owner's ruling of 2026-09-23. A company created with only a name
+ * used to be given the Generic default's marketplaces, which no screen listed and which the company page
+ * then refused to let anybody remove. A new company now starts with an empty list and somebody picks
+ * from the Generic default's marketplaces, which the portal offers as suggestions. With an empty list the
+ * general web search and the meaning checks still run, and so do any stores the engine chooses for a matter
+ * (pipeline.mjs deriveGridSpec).
  */
-export function resolvePlatforms(supplied, roster) {
+export function resolvePlatforms(supplied) {
   if (supplied?.length) return { platforms: supplied, source: "supplied" };
-  const house = roster?.get?.("generic")?.platforms ?? [];
-  if (!house.length)
-    throw new Refusal(
-      "no --platforms was given and the Generic default carries none, so there is nothing to onboard this "
-      + "brand owner with. Pass --platforms, or repair the generic profile in the store.",
-      { code: "no_marketplaces" });
-  return { platforms: [...house], source: "house default" };
+  return { platforms: [], source: "none" };
 }
 
 export function buildProfile({ key, name, domains, platforms, framework, industry,

package/driver/door-call-verdict.mjs

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// A CALL TO THE OPS DOOR THAT THE DEPLOYMENT CHECK COULD NOT MAKE — "roster resolves" (list_profiles) and
+// "ops-MCP reachable" (describe_options). Extracted so it can be driven without a door to call, as
+// plan-run-agreement-verdict.mjs was for the third call.
+//
+// Both rows used to FAIL on every error but an unset door, so the check exited 1, "drifted", when nothing
+// had been compared. Measured on pre-prod 0.3.3-beta.0: both rows FAILed on a 401, the door refusing the
+// check's own key. On the test box the same door's rate limit (429) refused the third call of a burst of
+// checks; that was the plan_run call, and these two go to the same door.
+//
+// THREE ANSWERS MEAN THE CHECK DID NOT LOOK: a rate limit (429), a refusal of this check's own key (401,
+// 403), and a request that got no answer in time. Each is a marked skip, which exits 3. Everything else
+// stays a FAIL: a 5xx or a malformed answer is the door answering badly. A door with nothing listening
+// at all stays a FAIL too, because whether that is a finding is not settled, and this does not settle it.
+
+/**
+ * @param {Error & {status?: number|null, timedOut?: boolean}} e  what the call threw
+ * @param {{ asked: string, notCompared: string }} what  the tool asked, and what was therefore not compared
+ * @returns {{state: "skip", blocked: true, message: string} | null}  null: report it as the FAIL it was
+ */
+export function doorCallVerdict(e, { asked, notCompared }) {
+  const refused = e?.status === 429 || e?.status === 401 || e?.status === 403 || e?.timedOut === true;
+  if (!refused) return null;
+  return { state: "skip", blocked: true, message: `could not ask ${asked}, so ${notCompared} — ${String(e?.message ?? e).slice(0, 200)}` };
+}

package/driver/driver.config.mjs

@@ -693,8 +693,7 @@ export const MODELS = {
 // alias → full id; a value that's already a full provider/model id (contains "/") passes through.
 //
 // A BARE Anthropic id (dated or not — "claude-haiku-4-5-20251001", "claude-opus-5") normalises to the
-// catalog form too. The direct-API lanes (jx completions/judge/nativeread, driver.config JX_PROVIDERS)
-// name their model that way because that is what the Messages API takes, so without this one model named
+// catalog form too. Without this, one model named
 // in two spellings — dated and undated — would key apart in a rollup. The date suffix is dropped;
 // anything that does not look like a bare claude id is returned untouched, so a genuinely unknown model
 // still keys as-is rather than being guessed at.

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.3",
+  "version": "0.4.0-beta.0",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/pipeline.mjs

@@ -76,7 +76,7 @@ import { armCoverageForm, coverageFormInput, coverageFormPaths, coverageFormStam
 import { unionPlacementForm } from "./placement-union.mjs";
 import { readPlacementForm, readPlacementFormInput, writePlacementForm } from "./placement-form-io.mjs";
 import { dictatedPaths, findStrayArtifacts, treeSnapshot, findStrayInTree, matterSiblings, findStrayMatterSiblings } from "./stray-artifacts.mjs";   // — a run dir holds no document no stage dictated; — nor does the doctrine tree
-import { resolveProfile, resolveEffectiveProfile, derivedFloor, derivedBatchSize, applicantMatchesProfile, NEUTRAL_DELIVERY, deliveryForRun, recipeProseGuard, withRunPlatforms, profileStoreResolution } from "./profiles.mjs";   // adds profileStoreResolution — the CONFIG store's identity, beside the doctrine tree's
+import { resolveProfile, resolveEffectiveProfile, derivedFloor, derivedBatchSize, gridBatchFor, applicantMatchesProfile, NEUTRAL_DELIVERY, deliveryForRun, recipeProseGuard, withRunPlatforms, profileStoreResolution } from "./profiles.mjs";   // adds profileStoreResolution — the CONFIG store's identity, beside the doctrine tree's
 import { resolveSearchPolicy, gateResolvedPolicy, loadRecipes, policyFor, isRegisterOnly, reportIdentityFor, depthFor } from "./search-policy.mjs";
 import { profileOrdinals } from "./profile-selection.mjs";   // lever 3 — driver selection
 // THE OFFERING'S own sentence about where the native-language investigation can be bought. It reaches a
@@ -979,7 +979,12 @@ function deriveGridSpec(ctx) {
     terms: null,
     spec_inputs: { registerOnly: Boolean(ctx.registerOnly), gridVariants: ctx.gridVariants?.length ?? 0, profilePlatforms: ctx.profile?.platforms?.length ?? 0 },
   };
-  if (!ctx.registerOnly && ctx.gridVariants?.length && ctx.profile?.platforms?.length) {
+  // AN EMPTY MARKETPLACE LIST STILL WRITES A GRID. A company may pick no marketplaces (the owner's ruling of
+  // 2026-09-23), and the general-web cell and the meaning sweep ride in this spec: gating it on a non-empty
+  // list switched both off with the stores, and the downgrade clamp then read the missing spec as a failed
+  // sweep. The spec below is then the web cell plus whatever channels the matter frame names. Only a profile
+  // with no list at all (legacy) takes the spec-less path.
+  if (!ctx.registerOnly && ctx.gridVariants?.length && Array.isArray(ctx.profile?.platforms)) {
     const gridSpecPath = P.gridSpec;
     // #5 — required channels: a NAMED profile's curated platforms are authoritative. The GENERIC fallback
     // derives the channels from the MATTER FRAME's industry/goods reasoning (its "Search channels:" line) so
@@ -1041,7 +1046,8 @@ function deriveGridSpec(ctx) {
       terms: ctx.gridVariants,
       platforms: [...channels, "web"], // the dictated channels + the general-web cell
       output_path: P.commonLawGrid,
-      batch: ctx.profile?.batchSize ?? 14,
+      // SIZED BY THE CELLS THIS GRID RUNS, never larger than the profile's own figure (gridBatchFor).
+      batch: gridBatchFor(ctx.profile, channels.length + 1),
       // disposition_required (P2-C §8b leg 2): the receipt-presence stamp arming the commonLaw validator's
       // receipts-disposition arm (the D1 ledger_required pattern — every fresh spec carries it; pre-P2-C
       // archived specs lack it, so replay verdicts never flip). splitGridSpec spreads the connotation
@@ -10591,10 +10597,13 @@ async function pipelineInner(job, opts = {}) {
         // back-compat: a pre-doc-35 receipt keyed only on the cell set (no source channels)
         (priorReceipt.sig == null && !sourceChannels.length &&
           JSON.stringify((priorReceipt.requested ?? []).map(cellKey).sort()) === JSON.stringify(closable.map(cellKey).sort())));
+      // SIZED BY THE CELLS A CLOSURE GRID RUNS, as the main grid is (gridBatchFor): its spec carries only the
+      // platforms of the cells it closes.
+      const closureBatch = (cells) => gridBatchFor(ctx.profile, new Set(cells.map((c) => c.platform)).size);
       if ((closable.length || sourceChannels.length) && !alreadyAttempted) {
         const requested = closable;
         const variants = [...new Set(closable.map((c) => c.variant))];
-        const batchSize = ctx.profile?.batchSize ?? 14;   // WS-B: derived from the profile's platform count
+        const batchSize = closureBatch(closable);
         const batches = Math.max(1, Math.ceil(variants.length / batchSize));
         const gridCalls = batches + (sourceChannels.length ? 1 : 0);   // grid call(s) + a channel-sweep call (tokens-only: no $ estimate)
         note(`coverage closure: ${closable.length} machine-closable cell(s)${sourceChannels.length ? ` + ${sourceChannels.length} un-swept in-scope channel(s) [${sourceChannels.join(", ")}]` : ""} — one supplementary grid pass (${gridCalls} grid call(s))`);
@@ -10707,7 +10716,7 @@ async function pipelineInner(job, opts = {}) {
       }
       if (closable.length || exempt.length) {
         // Tokens-only (owner directive 2026-07-11): the offer names the work (grid calls), never a $ figure.
-        const batchesLeft = Math.max(1, Math.ceil([...new Set(closable.map((c) => c.variant))].length / (ctx.profile?.batchSize ?? 14)));
+        const batchesLeft = Math.max(1, Math.ceil([...new Set(closable.map((c) => c.variant))].length / closureBatch(closable)));
         const offer = ` — closable on instruction (${batchesLeft} supplementary grid call(s))`;
         ctx.coverageNote = `marketplace cells not executed: ${[...closable, ...exempt].map(cellKey).join("; ")}` +
           (closable.length ? ` — attempted in-loop and still unreachable${offer}` : "") +

package/driver/portal-mcp-client.mjs

@@ -83,7 +83,7 @@ function post(urlStr, { headers = {}, body = "", wantId = null, timeoutMs = 3000
     });
     // — a timeout got no status and therefore no answer; it is marked at the throw rather than
     // recognised later by its message, so nothing has to keep a regex in step with a sentence.
-    req.setTimeout(timeoutMs, () => { req.destroy(transportError(`MCP request timed out after ${timeoutMs}ms`, null)); });
+    req.setTimeout(timeoutMs, () => { req.destroy(Object.assign(transportError(`MCP request timed out after ${timeoutMs}ms`, null), { timedOut: true })); });
     req.on("error", (e) => reject(isSocketFailure(e) ? transportError(e.message, null) : e));
     req.end(body);
   });

package/driver/portal-request-origin.mjs

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// A STATE CHANGE MUST COME FROM THIS PORTAL'S OWN PAGES. The portal checked nothing about where a POST
+// came from: the session cookie's SameSite attribute was the whole defence in local mode, and behind a
+// proxy it was the proxy's cookie. A page on another site, or another app on this machine on another
+// port (a browser treats every port on one host as the same site), could make a signed-in browser change
+// state here. So every state-changing request is checked against this portal's own host, in both modes.
+//
+// THE HOST IS THE REQUEST'S OWN, NOT A LIST. `Host` is what the browser addressed. A proxy in front can
+// rewrite it, and then says the original in `X-Forwarded-Host`, which Caddy sets by default. A page on
+// another site cannot set either header on a victim's browser (a custom header forces a preflight the
+// portal never grants), so accepting a match on either is still a match on this portal's own name.
+// Compared with its port: another app on this machine differs only in the port.
+//
+// A DEFAULT PORT IS NO PORT. `https://portal.example` and `https://portal.example:443` are one origin, and
+// so are `http://h` and `http://h:80`. A browser's Origin never writes the default port, but a proxy or a
+// tunnel in front may write it into `Host`, and a plain comparison would then refuse every save the
+// portal's own pages make. So the port the Origin's scheme implies is taken off both sides before they are
+// compared, and only that one: `:443` beside an `http` Origin is still another port.
+//
+// A REQUEST WITH NEITHER `Origin` NOR `Sec-Fetch-Site` IS NOT FROM A BROWSER. Every current browser sends
+// one of them on a POST, and a script or `curl` sends neither. A script cannot be tricked into carrying
+// someone else's session, so there is nothing to refuse, and its own credential still has to pass.
+
+const STATE_CHANGING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+const first = (v) => String(Array.isArray(v) ? v[0] : (v ?? "")).split(",")[0].trim();
+
+const DEFAULT_PORT = { "https:": "443", "http:": "80" };
+
+/** `host` without the port `protocol` implies, when it carries exactly that one. */
+function withoutDefaultPort(host, protocol) {
+  const port = DEFAULT_PORT[protocol];
+  return port && host.endsWith(`:${port}`) ? host.slice(0, -(port.length + 1)) : host;
+}
+
+/** The hosts this request says it was addressed to, lower-case, with their ports, less the default one. */
+function ownHosts(headers, protocol) {
+  return new Set([first(headers?.host), first(headers?.["x-forwarded-host"])].filter(Boolean)
+    .map((h) => withoutDefaultPort(h.toLowerCase(), protocol)));
+}
+
+/**
+ * Why this request is refused as coming from somewhere other than this portal, or null to let it through.
+ * @param {{ method?: string, headers?: Record<string, string|string[]|undefined> }} req
+ * @returns {string|null}
+ */
+export function crossSiteReason(req) {
+  if (!STATE_CHANGING.has(String(req?.method ?? "GET").toUpperCase())) return null;
+  const headers = req?.headers ?? {};
+  const origin = first(headers.origin);
+  if (origin) {
+    if (origin === "null") return "Origin is null";
+    let host, protocol;
+    try { ({ host, protocol } = new URL(origin)); } catch { return "Origin is not an address"; }
+    host = withoutDefaultPort(host.toLowerCase(), protocol);
+    const own = ownHosts(headers, protocol);
+    return own.has(host) ? null : `Origin ${host} is not this portal (${[...own].join(", ") || "no Host"})`;
+  }
+  const site = first(headers["sec-fetch-site"]).toLowerCase();
+  if (site) return site === "same-origin" || site === "none" ? null : `Sec-Fetch-Site is ${site}`;
+  return null;
+}
+
+/**
+ * Whether a state-changing request carries a body that is not declared as JSON. The API reads every body as
+ * JSON; a form post (`text/plain`, `application/x-www-form-urlencoded`) is the shape a page on another site
+ * can send without a preflight, so it is refused here rather than parsed. A request with no body is not
+ * asked for a type: the portal's own pages send none on a POST that carries nothing.
+ */
+export function bodyNotJson(req) {
+  if (!STATE_CHANGING.has(String(req?.method ?? "GET").toUpperCase())) return false;
+  const headers = req?.headers ?? {};
+  const length = Number(first(headers["content-length"]) || 0);
+  const hasBody = length > 0 || Boolean(first(headers["transfer-encoding"]));
+  if (!hasBody) return false;
+  const type = first(headers["content-type"]).split(";")[0].trim().toLowerCase();
+  return type !== "application/json";
+}

package/driver/portal-service.mjs

@@ -168,6 +168,7 @@ import { engineCommit } from "./engine-build.mjs";                  // — the S
 import { engineCommitDate, engineProvenance } from "./engine-build.mjs";
 import { classifySkillsStore } from "./skills-store-provenance.mjs";
 import { makeStaticHandler, reportCsp, docCsp } from "./portal-static.mjs";
+import { crossSiteReason, bodyNotJson } from "./portal-request-origin.mjs";
 import { bundleVerdict, healthUi } from "../shared/bundle-freshness.mjs";   // one definition of a usable bundle, shared with `doctor`
 import { readReport, reportsOf, resolveReportFile, batchSummaryOf } from "./portal-report.mjs";
 import { readArchivedSet, updateArchived } from "./publish/archive-tags.mjs";
@@ -1142,7 +1143,7 @@ export function makeConnectorKeyRevoker({ env = process.env, home = null } = {})
     const base = home ?? homedir();
     const recorded = recordedKeysFor(g, email);
     const plan = disablePlan({ env, unitDir: join(base, ".config", "systemd", "user"), exists: existsSync,
-      identity: email, recorded, denylistPath: denylistPathFor(env, base) });
+      identity: email, recorded, denylistPath: denylistPathFor(env, base), home: base });
     if (!plan.possible) return { grants: g, revoked: 0, jtis: [], lateArm: false, says: plan.says };
     if (plan.lateArm) return { grants: g, revoked: 0, jtis: plan.jtis, lateArm: true, says: plan.says ?? [] };
     // THE RECORD IS NEVER STRUCK FROM HERE, and the ledger step is dropped rather than no-opped.
@@ -1614,6 +1615,7 @@ export function makePortalService({
         // identity gets {} here exactly as it does for names and keeps reading the staff-only roster.
         let accountNames = {};
         let accountFacts = {};
+        let meRoster = null;   // read once for this answer: the names below and the house marketplaces
         // GENERIC IS NAMED TOO when the person sees an organisation's Generic. It is not a company, so it is
         // never in `accounts`, and without a name here the switcher printed the raw key at everyone below
         // everything. An organisation with no company yet is the case with an empty `accounts`, so the
@@ -1623,7 +1625,7 @@ export function makePortalService({
         if (named.length) {
           try {
             const { companyFactsOf } = await import("./profiles.mjs");
-            const profiles = await loadProfilesImpl();
+            const profiles = meRoster = await loadProfilesImpl();
             for (const key of named) {
               const profile = profiles.get(key);
               const name = profile?.name;
@@ -1662,9 +1664,19 @@ export function makePortalService({
         // READ ONCE. The payload names it and the program reading below is gated on it; two calls to
         // `flagView` here would be two reads of the same file that could disagree with each other.
         const meEngineMode = flagView(poolRoot).engineMode;
+        // THE HOUSE MARKETPLACES, offered as suggestions wherever a company's marketplaces are edited. A new
+        // company starts with none (the owner's ruling of 2026-09-23) and somebody picks; these are the
+        // Generic default's own list, read from the store so an install that changed it offers its own.
+        // Deployment-wide and the same for everyone, like concurrentRuns. [] when the store cannot be read:
+        // the box still takes any marketplace typed into it.
+        let houseMarketplaces = [];
+        try {
+          const house = (meRoster ?? await loadProfilesImpl()).get("generic")?.platforms;
+          if (Array.isArray(house)) houseMarketplaces = house.filter((d) => typeof d === "string" && d.trim());
+        } catch { /* a suggestion list is a nicety; the door is not */ }
         return { status: 200, json: { email: principal.email, ...principalView(principal, grantsHere, accountNames),
           accounts: principal.accounts, accountNames, accountFacts,
-          concurrentRuns: concurrentRunsCap(), brand: ORGANISATION_NAME, engineMode: meEngineMode,
+          concurrentRuns: concurrentRunsCap(), brand: ORGANISATION_NAME, engineMode: meEngineMode, houseMarketplaces,
           // WHERE A PERSON ASKS FOR A CHANGE TO THEIR SIGN-IN, beside the brand and read where it is read:
           // an href Preferences links "Clearotron administrator" to, or null, and then the words are plain.
           administratorContact: ADMINISTRATOR_CONTACT,
@@ -3267,15 +3279,12 @@ async function connectorDoorKind(url) {
             const p = envFrom(process.env, "CLEAROTRON_ACCESS_FILE");
             if (p) grantsFile = { name: basename(p), modifiedAt: new Date(statSync(p).mtimeMs).toISOString() };
           } catch { /* reported as unknown; a failed stat must not take down the page that explains access */ }
-          // WHETHER AN ISSUED KEY CAN BE WITHDRAWN AT ALL, read the same way `disablePlan` reads it: the
-          // door loaded a revocation list at start, or it did not and never will for the keys already
-          // out. The variable's PRESENCE is the whole question — its value is a path, and this route
-          // must not say where.
-          // WHETHER A REVOCATION LIST IS NAMED FOR THIS PROCESS AT ALL — which is not the same question
-          // as whether the connector loaded one, and the page's words are careful about the difference.
-          // The connector is a separate unit with its own environment; this answers only for here.
-          const keysRevocable = Boolean(revokeConnectorKeys)
-            && String(process.env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim() !== "";
+          // WHETHER AN ISSUED KEY CAN BE WITHDRAWN AT ALL. This used to be whether a revocation list was
+          // named in this process's environment, because a door with none named checked no list. Every door
+          // now reads the install's default list when none is named (isRevoked, shared/scope.mjs), and that
+          // is where a revocation from here is written, so keys can be withdrawn whenever this process has
+          // a revoker at all.
+          const keysRevocable = Boolean(revokeConnectorKeys);
           return { status: 200, json: accessView({ grants: grantsHere, viewer: principal, companies, grantsFile, localSignIn, keysRevocable }) };
         }
         // /portal/admin/people — give someone access. Manage-gated above; everything else is decided here.
@@ -3641,9 +3650,10 @@ export function accountCapAdvice(posture) {
   }
   return "Re-mint with `mcp-server/mint-token.mjs --scope ops"
     + `${posture.sub ? ` --sub ${posture.sub}` : ""}`
-    // NO `--verbs` FLAG AT ALL when the token is full-ops: `verbs: null` means EVERY verb, and naming a
-    // list there would be the narrowing this whole function exists to stop.
-    + `${posture.verbs ? ` --verbs ${posture.verbs.join(",")}` : ""}`
+    // A FULL-OPS TOKEN (`verbs: null`) IS RE-ISSUED WITH THE PORTAL'S OWN VERBS. It used to get no
+    // `--verbs` at all, so as not to narrow it; mint-token now refuses an ops token that names none, so that
+    // command would fail, and re-issuing verb-less tokens with verbs is the point. The portal calls these two.
+    + ` --verbs ${(posture.verbs ?? ["start_run", "stop_run"]).join(",")}`
     + " --accounts <keys>` to make it two walls.";
 }
 
@@ -4288,6 +4298,18 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         });
       }
 
+      // ── A STATE CHANGE FROM ANOTHER SITE IS REFUSED BEFORE ANYTHING ELSE LOOKS AT IT ────────────────
+      //
+      // Before identity, so the sign-in and sign-out forms are covered as well as the API: a page elsewhere
+      // that signs a browser in to an account of its choosing is the same attack as one that acts under the
+      // browser's own session. The rule and why it compares hosts is in portal-request-origin.mjs.
+      const crossSite = crossSiteReason(req);
+      if (crossSite) {
+        log(`refused a ${req.method} to ${url.pathname} from another site: ${crossSite}`);
+        journal(403, "cross-site request");
+        return send(res, 403, { error: "cross_site" });
+      }
+
       // ──: THE LOCAL SIGN-IN DOOR — before identity, because it is how identity is obtained ─────
       //
       // Mounted only when the local identity provider is running. On a Cloudflare-fronted instance
@@ -4420,6 +4442,12 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         journal(429, "rate_limited", identity?.email);
         return send(res, 429, { error: "rate_limited" });
       }
+      // A BODY THAT DOES NOT SAY IT IS JSON IS NOT READ AS JSON. A form post is the one body another site
+      // can send without asking first; the portal's own pages always declare JSON when they send a body.
+      if (bodyNotJson(req)) {
+        journal(415, "body is not JSON", identity?.email);
+        return send(res, 415, { error: "unsupported_media_type" });
+      }
       // A FIXED reason, not `e.message`. The parser's message is about the bytes it was given, and this
       // row must not become a place a caller can write into by sending a body that fails to parse.
       let body;

package/driver/profile-page.html

@@ -214,7 +214,7 @@ function renderEditor(key, p, contextPack, derived, framework, isNew) {
   $("editor").innerHTML = `
     ${isNew ? f("Customer key"+REQ, "f_key", "", `<span class="reqtag">Required.</span> A short lowercase id — letters, numbers and hyphens only. It becomes the customer's filename and can't be changed later.`, "e.g. acme-health") : `<div class="ro">Editing <b><span data-anon="mark" data-anon-key="${esc(key)}">${esc(key)}</span></b></div>`}
     ${f("Customer name"+REQ, "f_name", p.name||"", `<span class="reqtag">Required.</span> The customer's name. We use it to recognise their own marks so we never flag the customer against itself.`, undefined, true)}
-    ${ta("Marketplaces and registers to search"+REQ, "f_platforms", (p.platforms||[]).join("\n"), `<span class="reqtag">Required — at least one.</span> One website per line (e.g. amazon.com). These are where we look for real-world use of a mark. Don't add 'web' — the general web is always searched.`, "", true)}
+    ${ta("Marketplaces and registers to search", "f_platforms", (p.platforms||[]).join("\n"), `One website per line (e.g. amazon.com). These are where we look for real-world use of a mark. Don't add 'web' — the general web is always searched.`, "", true)}
     ${coverageNote}
     <details class="more"${advancedSet?" open":""}>
       <summary>More options</summary>
@@ -344,18 +344,15 @@ function clientValidate({ key, profile }) {
     else if (!KEY_RE.test(key)) problems.push({ id:"f_key", message:"The customer key can only use lowercase letters, numbers and hyphens (2–39 characters)." });
   }
   if (!profile.name) problems.push({ id:"f_name", message:"Enter the customer’s name." });
+  // An empty list is valid: a company may pick no marketplaces (the owner's ruling of 2026-09-23).
   const plats = profile.platforms || [];
-  if (!plats.length) {
-    problems.push({ id:"f_platforms", message:"Add at least one marketplace or register to search — a website like amazon.com, one per line." });
-  } else {
-    const seen = new Set();
-    for (const x of plats) {
-      const dom = x.toLowerCase();
-      if (dom === "web") { problems.push({ id:"f_platforms", message:"Don’t list “web” — the general web is always searched. Remove it." }); continue; }
-      if (!DOMAIN_RE.test(dom) || /\s/.test(dom)) { problems.push({ id:"f_platforms", message:`“${x}” doesn’t look like a website address — use a domain like amazon.com.` }); continue; }
-      if (seen.has(dom)) { problems.push({ id:"f_platforms", message:`“${x}” is listed twice.` }); continue; }
-      seen.add(dom);
-    }
+  const seen = new Set();
+  for (const x of plats) {
+    const dom = x.toLowerCase();
+    if (dom === "web") { problems.push({ id:"f_platforms", message:"Don’t list “web” — the general web is always searched. Remove it." }); continue; }
+    if (!DOMAIN_RE.test(dom) || /\s/.test(dom)) { problems.push({ id:"f_platforms", message:`“${x}” doesn’t look like a website address — use a domain like amazon.com.` }); continue; }
+    if (seen.has(dom)) { problems.push({ id:"f_platforms", message:`“${x}” is listed twice.` }); continue; }
+    seen.add(dom);
   }
   return problems;
 }
@@ -366,7 +363,6 @@ function prettyServerError(msg) {
   const M = String(msg||"");
   const MAP = [
     [/name \(string\) is required/i,                    "f_name",      "Enter the customer’s name."],
-    [/platforms must be a non-empty array/i,            "f_platforms", "Add at least one marketplace or register to search — a website like amazon.com, one per line."],
     [/must not list "web"/i,                            "f_platforms", "Don’t list “web” — the general web is always searched. Remove it."],
     [/must be a bare store DOMAIN/i,                     "f_platforms", "One of the marketplaces isn’t a website address — use domains like amazon.com, one per line."],
     [/is duplicated/i,                                  "f_platforms", "A marketplace is listed twice — remove the duplicate."],