clearotron 0.3.3 → 0.4.0-beta.1

package/driver/unit-inventory.mjs

@@ -516,7 +516,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // `untrackedReason` above is kept in the PAST tense of its own finding on purpose: it records how
     // this unit was discovered — by enumerating production, not by reading a list — and that is history
     // the stop does not erase.
-    orphanReason: "STOPPED AND DISABLED ON PRODUCTION 2026-08-20 on the owner's word (#1437), so it runs "
+    orphanReason: "STOPPED AND DISABLED ON PRODUCTION 2026-08-20 on the owner's word, so it runs "
       + "on no box and `runsOn` is empty. It is not deleted: the unit file, scripts/feedback-mint.mjs and "
       + "the whole capture path are intact, and `systemctl --user enable --now feedback-mint.timer` as "
       + "the service account puts it back. It drained a store that never existed — /srv/trademark-archive/_feedback "
@@ -524,8 +524,8 @@ export const UNIT_INVENTORY = Object.freeze([
       + "flag was ever captured, so stopping it dropped nothing. The decision owed, if any, is whether the "
       + "feedback machinery is removed rather than parked; driver/run-activity.mjs still carries a note "
       + "addressed to whoever picks that up, and it is still unclaimed.",
-    note: "STOPPED. Production ran it every 30 minutes against an input nothing writes to any more "
-      + "(#1437); the owner's word came 2026-08-20 and it was disabled the same evening.",
+    note: "STOPPED. Production ran it every 30 minutes against an input nothing writes to any more"
+      + "; the owner's word came 2026-08-20 and it was disabled the same evening.",
   },
   // ── OTHER REPOS' UNITS, SHARING THE BOX ───────────────────────────────────────────────────────────
   // Declared, not adopted. A unit this repo does not own is still a unit the arm enumerates, and an

package/driver/variant-manifest-model.mjs

@@ -332,7 +332,7 @@ export function variantRomanizationGaps(model) {
  *   which is also where the incident string came from.
  *
  *   `watchlist_owners` — those compile to `predicate:"owner"`, exempt from every term rule because
- *   owner names are prose by nature ("Delphi Technologies (BorgWarner Inc.)").
+ *   owner names are prose by nature ("Korphi Technologies (BorgWarner Inc.)").
  */
 // — `termAnnotationIssue` moved to term-shape.mjs, the ONE term vocabulary, so the plan
 // compiler applies the SAME predicate this gate does rather than a second copy of it.

package/driver/verify.mjs

@@ -848,7 +848,7 @@ export const CORRECTION_KINDS = ["coverage-disposition", "fact", "rating", "narr
 const CORRECTION_KIND_RE = /\[kind:\s*([a-z][a-z-]*)\s*\]/i;
 // — THE SECOND CHANNEL: WHICH FINDING A FLAG IS ABOUT.
 //
-// The reviewer already writes it, in prose — a delivered review's flags open "Finding 9 — DELPHIC…",
+// The reviewer already writes it, in prose — a delivered review's flags open "Finding 9 — KORPHIC…",
 // "Findings 4, 7, 8." — and the driver could not read it: `targetsOf` matched mark/owner NAMES and
 // returned nothing for six of nine flags on that run. So the corrective pass re-emitted the whole
 // narrative and the whole findings.json, for 683 seconds, and exactly ONE finding moved.
@@ -2574,7 +2574,7 @@ function checkClientSummaryJoin(p, c) {
     const risk = body.match(/^-\s*risk:\s*([A-Za-z –-]+)$/m)?.[1]?.trim();
     if (!risk) continue;
     // wp50: deterministic join (ord line → exact mark → unique containment). The old first-match
-    // containment join bound "DEMVENZY — Novartis" to the VENZY finding and VALIDATED the wrong tier.
+    // containment join bound "DEMVENZY — Norvanta" to the VENZY finding and VALIDATED the wrong tier.
     const f = joinFindingToBlock({ ord: parseBlockOrd(body), head }, findingsDoc.findings);
     if (!f) continue;                                                              // unjoinable block — shape checks own it
     if (v4) {

package/driver/whatif-memo-run.mjs

@@ -97,7 +97,7 @@ export function movedArtifacts(before = {}, after = {}) {
  *
  * ✕ EVERYTHING ELSE IS THE SEAT WRITING WHERE IT WAS NOT INVITED, and it is refused by name. The seat
  * has a real file-write grant on the run directory, and on a delivered run it used it: an archived
- * client run carries `memo-osler-coexistence.json` at its root, which is the seat's reply written to a
+ * client run carries `memo-halver-coexistence.json` at its root, which is the seat's reply written to a
  * path of its own choosing instead of to the `expectFile` it was given. That also explains the retry
  * that preceded it — the harness looked for the reply where it had asked for it and did not find it.
  *

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-artifacts-mcp
 
+## 0.4.0-beta.1
+
+No changes in this release.
+
+## 0.4.0-beta.0
+
+No changes in this release.
+
 ## 0.3.3
 
 No changes in this release.

package/mcp-server/lib/audit.mjs

@@ -50,7 +50,7 @@ export function summarize(body) {
  */
 export const UNNAMED_DOOR = "unnamed";
 
-export function appendAudit({ email, sub, body, status, transport, door, path = DEFAULT_AUDIT_PATH }) {
+export function appendAudit({ email, sub, kind = null, namesVerbs = null, body, status, transport, door, path = DEFAULT_AUDIT_PATH }) {
   // `sub` = the inner-token PRINCIPAL (ops-token issuance, INSTALL.md §8) — distinguishes
   // two automations sharing a transport identity. null for internal/user sessions without a sub claim.
   //
@@ -69,7 +69,14 @@ export function appendAudit({ email, sub, body, status, transport, door, path =
   // WRITTEN ONLY WHEN GIVEN, the same rule as `transport` and for the same reason: the existing log
   // shape must not move for records that have no answer to this. A door that does not name itself is a
   // record with no `door` key, not a record claiming to be from nowhere.
-  const line = JSON.stringify({ ts: new Date().toISOString(), email: email ?? null, sub: sub ?? null, ...summarize(body), status: status ?? null, ...(transport ? { transport } : {}), door: door || UNNAMED_DOOR }) + "\n";
+  //
+  // `kind` is the principal's kind (ops, user, account, internal), and `namesVerbs` says, for an ops token
+  // only, whether it names its write verbs. An ops token that names none is being retired: re-issued with
+  // verbs, then refused once this log shows none in use. So the log must be able to count them. Written
+  // only when given, by the same rule as `transport`: a caller that never knew writes no claim.
+  const line = JSON.stringify({ ts: new Date().toISOString(), email: email ?? null, sub: sub ?? null,
+    ...(kind ? { kind } : {}), ...(typeof namesVerbs === "boolean" ? { namesVerbs } : {}),
+    ...summarize(body), status: status ?? null, ...(transport ? { transport } : {}), door: door || UNNAMED_DOOR }) + "\n";
   try { mkdirSync(dirname(path), { recursive: true }); appendFileSync(path, line); } catch { /* best-effort */ }
 }
 

package/mcp-server/lib/http-handler.mjs

@@ -278,7 +278,11 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
               : send(res, 401, { error: `invalid trademark token: ${e.message}` });
           }
           const transport = await createSession(sessions, scope, user.email);
-          entry = { transport, sub: scope.sub ?? null, kind: scope.kind ?? null };
+          // `namesVerbs` rides with the session so EVERY call it makes is audited with it, not only the
+          // first: an ops token that names no verbs is being retired (re-issued with verbs, then refused),
+          // and the audit is how the live ones are found. Whether it names verbs, never which, never the token.
+          const namesVerbs = scope.kind === "ops" ? Array.isArray(scope.verbs) && scope.verbs.length > 0 : null;
+          entry = { transport, sub: scope.sub ?? null, kind: scope.kind ?? null, namesVerbs };
           // STAMP THE SCOPE'S OWN FACTS ONTO THE STORED ENTRY, HERE, AND AFTER THE HANDSHAKE.
           //
           // `createSession` is injected, and every caller carries its own copy of the entry shape — two
@@ -293,7 +297,7 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
           // and left the gate reading a field nobody had set — green, and doing nothing.
           stampScope = () => {
             const stored = transport.sessionId ? sessions.get(transport.sessionId) : null;
-            if (stored) { stored.sub = scope.sub ?? null; stored.kind = scope.kind ?? null; }
+            if (stored) { stored.sub = scope.sub ?? null; stored.kind = scope.kind ?? null; stored.namesVerbs = namesVerbs; }
           };
         } else {
           if (entry.email && entry.email !== user.email) {
@@ -328,7 +332,7 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
         // `finish` fires once the response is fully sent, which is when `res.statusCode` is the answer
         // the caller got rather than the default it started as.
         res.once("finish", () => {
-          try { appendAudit({ email: user.email, sub: entry.sub ?? null, body, status: res.statusCode, door }); }
+          try { appendAudit({ email: user.email, sub: entry.sub ?? null, kind: entry.kind ?? null, namesVerbs: entry.namesVerbs ?? null, body, status: res.statusCode, door }); }
           catch { /* best-effort */ }
         });
         const answered = entry.transport.handleRequest(req, res, body);

package/mcp-server/mint-token.mjs

@@ -15,7 +15,7 @@
 // intake connector never needs stop_run.
 
 import { fileURLToPath } from "node:url";
-import { mintToken, verifyToken, TOOL_SCOPES } from "../shared/scope.mjs";
+import { mintToken, verifyToken } from "../shared/scope.mjs";
 import { homedir } from "node:os";
 import { defaultDenylistPath } from "../shared/client-door.mjs";   // — one owner for the path
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-point test, all spellings
@@ -25,7 +25,7 @@ function fail(msg, code = 1) { process.stderr.write(`mint-token: ${msg}\n`); pro
 const USAGE = `usage: node mint-token.mjs --scope ops|user|account [options]
   --scope ops        an automation/operator principal (write verbs allowed)
     --sub <name>       REQUIRED for ops: the principal name (rides into the audit log)
-    --verbs a,b        least-privilege write-verb allowlist (recommended; omit = full ops)
+    --verbs a,b        REQUIRED for ops: the write tools this token may call
     --accounts a,b     GRANTS cap: the account keys (profileKeys) this token may see/start (omit = all)
     --ttl-days <n>     default 30
   --scope user       a run-bound report-link token (read-only client layer)
@@ -76,6 +76,12 @@ export function mintFromOptions({ scope, sub = null, runId = null, ttlDays, verb
   // They belong here rather than at either caller for exactly the reason the extraction existed: a rule
   // enforced by one of two callers is a rule the other one does not have.
   if (scope === "ops" && !sub) throw new Error("--sub is required for an ops token — the audit log must name the principal");
+  // AN OPS TOKEN NAMES ITS VERBS. One that named none held every write verb, and over the network that
+  // included starting a what-if; it is the most valuable credential the product issues, so it is no longer
+  // issued. Tokens already out keep working: the door records their use (the audit line's `namesVerbs`) so
+  // they can be found, re-issued with verbs and then refused, in that order.
+  if (scope === "ops" && !(Array.isArray(verbs) && verbs.length))
+    throw new Error("--verbs is required for an ops token — name the write tools it may call, for example --verbs start_run,stop_run");
   if (scope === "user" && !runId) throw new Error("--run is required for a user token (it is bound to exactly one run)");
   if (scope === "account" && !sub) throw new Error("--sub is required for an account key — it names the grants-file identity the key reads its accounts from");
   if (!Number.isFinite(ttlDays) || ttlDays <= 0) throw new Error("--ttl-days must be a positive number");
@@ -110,10 +116,6 @@ export function mintFromOptions({ scope, sub = null, runId = null, ttlDays, verb
   notes.push(`revoke this TOKEN specifically: add "${t.jti}" as a line in ${denylistFile()}`);
   if (scope === "account")
     notes.push(`the grants row IS the reach — an account key reads its accounts from the grants file on every request`);
-  if (scope === "ops" && !verbs) {
-    const writable = Object.keys(TOOL_SCOPES).filter((k) => TOOL_SCOPES[k].write);
-    notes.push(`note: FULL ops authority (${writable.join(", ")}) — consider --verbs for automation principals`);
-  }
   return { token, claims: t, notes };
 }
 

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.3",
+  "version": "0.4.0-beta.1",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/mcp-server/server.mjs

@@ -668,7 +668,7 @@ const TOOL_DEFS = [
   { name: "plan_run", description: "FREE PREVIEW — resolve what a search WOULD do and return it, spending nothing and queueing nothing. Takes the SAME arguments as start_run. Use this BEFORE start_run whenever the requester has not already confirmed the specifics: it reports the PRODUCT that resolves and WHERE it came from (their request, the account default, a saved search, or the territories themselves), the territories and marketplaces that would ACTUALLY be searched, the turnaround, and any blockers as questions to put back. Show the result to the requester; then call start_run with the SAME arguments to actually run it. Nothing here reserves or holds anything.", inputSchema: { type: "object", properties: { markName: { type: "string", description: "The mark (single-mark form). REQUIRED unless marks[] is given." }, marks: { type: "array", items: { type: "object", properties: { name: { type: "string" }, classes: { type: "array", items: { type: "number" } }, ref: { type: "string" } }, required: ["name"] } }, classes: { type: "array", items: { type: "number" } }, goods: { type: "string" }, jurisdictions: { type: "array", items: { type: "string" }, description: JURISDICTIONS_DESC }, platforms: { type: "array", items: { type: "string" } }, customer: { type: "string" }, profileKey: { type: "string", description: "The customer ACCOUNT key (see list_profiles). OMIT it for a new or unknown client and the search runs under the neutral generic profile, which is never a reason to refuse a search — offer that and the portal route (their own company, with its own framework and territories) in the same reply. On a session whose access names accounts, omitting it needs the generic profile to be one of them; when it is not, the refusal says so and names what the session does hold (see describe_options)." }, projectKey: { type: "string" }, forwarder: { type: "string", description: "Requester/reply-routing key — same as start_run, so the preview describes the job that would actually be built. Account sessions may omit it — it is stamped from your verified identity." }, forwarderEmail: { type: "string" }, ref: { type: "string" }, product: { type: "string", enum: ORDERABLE_PRODUCTS, description: PRODUCT_DESC }, nativeLanguage: { type: "boolean", description: "OPTIONAL, and only on a multi-country-focus-search: the native-language investigation. Send TRUE or omit the field — FALSE IS REFUSED, not honoured: the toggle only ever added, so there is nothing for false to switch off, and accepting it would let you believe you had removed a reading that runs anyway. It runs AUTOMATICALLY on a full-country-search and is not part of the other two, so asking for it there is refused rather than accepted and ignored. It routes on territory — the scope must name one it covers." }, worldwide: { type: "boolean", description: "Search EVERYWHERE, and refuse to be narrowed by the account's own default territories. This is not the same as omitting jurisdictions, which means \"whatever the account says\" — the two used to be indistinguishable on this wire, which is how a request that bought everywhere ran an account's seven countries. Never send \"Worldwide\" as a jurisdictions entry." }, recipeKey: { type: "string" }, upfrontInstructions: { type: "string" }, deadline: { type: "string" }, deliveryRoute: { type: "string", enum: ["email", "portal"], description: "OPTIONAL: how the delivered packet leaves — email (default). \"portal\" is reserved for the portal delivery lane and CLARIFIES at admission until it ships (never a silent no-op) — so the preview BLOCKS it here rather than describing a job start_run could not run." }, commercialFlexibility: { type: "string" }, priorUse: { type: "string" }, campaignShape: { type: "string", description: "Campaign-shape FACTS from the request/client — how the mark will be deployed: standalone brand vs flavour/sub-brand under a NAMED house mark; seasonal/limited vs permanent; launch scale. Verbatim facts only — the engine records them on the matter frame instead of inferring a launch shape." }, customerUnknown: { type: "boolean" } }, required: ["forwarder"] } },
   // ---- OPS write-face (requires an ops token; never exposed to a user/internal session) ----
   { name: "start_run", description: "OPS-ONLY. Enqueue a NEW clearance/search run the driver will pick up. Provide markName (or marks[] for a batch) + forwarder (and ideally classes/goods/customer/profileKey/ref). Returns the queue id + slug; the runId/codename is assigned when the runner claims it — poll list_runs (by markName) or run_changes for progress. Spends real money once it runs.", inputSchema: { type: "object", properties: { agent: { type: "string", description: "Which agent workspace's queue. Omit for the deployment default (CLEAROTRON_QUEUE_DIR or the default agent's queue — docs/INTAKE.md)." }, markName: { type: "string", description: "The mark (single-mark form). Required unless marks[] is provided." }, marks: { type: "array", items: { type: "object", properties: { name: { type: "string" }, classes: { type: "array", items: { type: "number" } }, ref: { type: "string" } }, required: ["name"] }, description: "Batch form: EVERY name of the batch in ONE job. Only a knockout-search reads more than one name at a time; a clearance reads one, and more is refused rather than truncated." }, classes: { type: "array", items: { type: "number" }, description: "Nice classes — whole numbers 1–45 (1–34 goods, 35–45 services). classes OR goods; either suffices." }, goods: { type: "string" }, jurisdictions: { type: "array", items: { type: "string" }, description: JURISDICTIONS_DESC }, platforms: { type: "array", items: { type: "string" }, description: "OPTIONAL per-run SCOPE: extra marketplaces to sweep, as bare store domains e.g. [\"gnc.com\"]. ADDED to the account's own marketplaces — additive only, never a replacement (a client's platform list is a mandate). Max 10; \"web\" is implicit and must not be listed." }, customer: { type: "string" }, profileKey: { type: "string", description: "The customer ACCOUNT key (see list_profiles) whose profile rates this run; omit for the neutral generic profile — that is how a clearance for a NEW client runs, and a client with no account yet is never a reason to refuse one. Offer it alongside the portal route (their own company, with its own framework, territories and marketplaces) so the requester chooses. On a session whose access names accounts, omitting it needs the generic profile to be one of them; when it is not, the refusal says so and names what the session does hold (see describe_options)." }, forwarder: { type: "string", description: "Requester/reply-routing key — rides the delivery packet so the integrator knows who gets the report (docs/DELIVERY.md). Account sessions may omit it — it is stamped from your verified identity." }, forwarderEmail: { type: "string" }, ref: { type: "string" }, provider: { type: "string" }, brief: { type: "string" }, upfrontInstructions: { type: "string" }, projectKey: { type: "string", description: "OPTIONAL (spec 62): the PROJECT/engagement key UNDER profileKey (see that customer's projects[] in list_profiles) whose overlay rates this run; omit to run on the customer profile. An unknown key clarifies at intake." }, product: { type: "string", enum: ORDERABLE_PRODUCTS, description: PRODUCT_DESC }, nativeLanguage: { type: "boolean", description: "OPTIONAL, and only on a multi-country-focus-search: the native-language investigation. Send TRUE or omit the field — FALSE IS REFUSED, not honoured: the toggle only ever added, so there is nothing for false to switch off, and accepting it would let you believe you had removed a reading that runs anyway. It runs AUTOMATICALLY on a full-country-search and is not part of the other two, so asking for it there is refused rather than accepted and ignored. It routes on territory — the scope must name one it covers." }, worldwide: { type: "boolean", description: "Search EVERYWHERE, and refuse to be narrowed by the account's own default territories. This is not the same as omitting jurisdictions, which means \"whatever the account says\" — the two used to be indistinguishable on this wire, which is how a request that bought everywhere ran an account's seven countries. Never send \"Worldwide\" as a jurisdictions entry." }, recipeKey: { type: "string", description: "OPTIONAL alternative selector: a saved search (recipe) slug for this customer. Mutually exclusive with product — a saved search already carries one." }, deliveryRoute: { type: "string", enum: ["email", "portal"], description: "OPTIONAL: how the delivered packet leaves — email (default). \"portal\" is reserved for the portal delivery lane and CLARIFIES at admission until it ships (never a silent no-op)." }, parentRunId: { type: "string", description: "OPTIONAL escalation lineage: the runId this run escalates from (e.g. a knockout HIGH mark → this clearotron)." }, deliverableSpec: { type: "string" }, commercialFlexibility: { type: "string" }, priorUse: { type: "string" }, campaignShape: { type: "string", description: "Campaign-shape FACTS from the request/client — how the mark will be deployed: standalone brand vs flavour/sub-brand under a NAMED house mark; seasonal/limited vs permanent; launch scale. Verbatim facts only — the engine records them on the matter frame instead of inferring a launch shape." }, deadline: { type: "string", description: "ISO-8601 — drives the deadline envelope." }, customerUnknown: { type: "boolean" }, dupOverride: { type: "boolean", description: "Requester-confirmed force-run past matter dedup." }, clientPrincipal: { type: "boolean", description: "Set by the client portal only: this run was started by a CLIENT and consumes that account's runCaps.dailyRuns allowance. Omit for staff, agent and email-door runs — absence means uncapped, and setting it can only restrict the run that carries it." }, rawRequest: { type: "string" }, forwarderDomain: { type: "string" }, msgId: { type: "string" }, conversationId: { type: "string" }, id: { type: "string" } }, required: ["forwarder"] } },
-  { name: "stop_run", description: "OPS-ONLY. Cancel a run. Pass id to remove a not-yet-claimed queued job (a real cancel, no spend). Pass runId to file a cancel request on a started run. By default the cancel is COOPERATIVE — the sentinel is written and a turn already in flight is allowed to finish, which has no deadline: a reasoning turn can run for tens of minutes. Add immediate:true to also end that turn: it is sent a stop, anything of it still running a few seconds later is killed, and the answer says the turn ended only once it has seen it end. If it could not be ended, the run ends at its next step boundary, and the answer says that instead.", inputSchema: { type: "object", properties: { agent: { type: "string" }, id: { type: "string", description: "A queued job id (from start_run) — dequeues before the runner claims it." }, runId: { type: "string", description: "A started run's runId — files a cancel sentinel." }, immediate: { type: "boolean", description: "Stop NOW instead of at the next step boundary. The cancel sentinel is written FIRST and then the run's own recorded engine turn is stopped, in that order — the sentinel is what makes the record clean, so the terminal names the stage, the actor and the request time instead of leaving a run that reads as still running. The turn is sent SIGTERM (to its whole process group when it leads one, as both engines spawn it, so the tools it started are reached too), watched, and sent SIGKILL if anything of it is still running when the grace runs out; the answer waits for that, which takes seconds. A turn that is stopped loses its step's work; everything already recorded is kept. Sending the stop is not the same as the turn ending, and the answer claims the second only when it has seen it (immediate.ended). Falls back to the boundary stop, and SAYS SO in the answer, when there is no live turn to signal — a run between steps, or one whose turn has already exited — or when the turn was still there after the SIGKILL. The answer states which of the two actually happened."}, onBehalfOf: { type: "string", description: "The identifier of a human this caller has itself verified (#1378). RECORDED BESIDE the token's own principal, never instead of it — a stop by the portal for alice@x is written `portal:alice@x`, so an asserted name is never mistaken for a proved one. Bare identifiers only; anything else is dropped." } } } },
+  { name: "stop_run", description: "OPS-ONLY. Cancel a run. Pass id to remove a not-yet-claimed queued job (a real cancel, no spend). Pass runId to file a cancel request on a started run. By default the cancel is COOPERATIVE — the sentinel is written and a turn already in flight is allowed to finish, which has no deadline: a reasoning turn can run for tens of minutes. Add immediate:true to also end that turn: it is sent a stop, anything of it still running a few seconds later is killed, and the answer says the turn ended only once it has seen it end. If it could not be ended, the run ends at its next step boundary, and the answer says that instead.", inputSchema: { type: "object", properties: { agent: { type: "string" }, id: { type: "string", description: "A queued job id (from start_run) — dequeues before the runner claims it." }, runId: { type: "string", description: "A started run's runId — files a cancel sentinel." }, immediate: { type: "boolean", description: "Stop NOW instead of at the next step boundary. The cancel sentinel is written FIRST and then the run's own recorded engine turn is stopped, in that order — the sentinel is what makes the record clean, so the terminal names the stage, the actor and the request time instead of leaving a run that reads as still running. The turn is sent SIGTERM (to its whole process group when it leads one, as both engines spawn it, so the tools it started are reached too), watched, and sent SIGKILL if anything of it is still running when the grace runs out; the answer waits for that, which takes seconds. A turn that is stopped loses its step's work; everything already recorded is kept. Sending the stop is not the same as the turn ending, and the answer claims the second only when it has seen it (immediate.ended). Falls back to the boundary stop, and SAYS SO in the answer, when there is no live turn to signal — a run between steps, or one whose turn has already exited — or when the turn was still there after the SIGKILL. The answer states which of the two actually happened."}, onBehalfOf: { type: "string", description: "The identifier of a human this caller has itself verified. RECORDED BESIDE the token's own principal, never instead of it — a stop by the portal for alice@x is written `portal:alice@x`, so an asserted name is never mistaken for a proved one. Bare identifiers only; anything else is dropped." } } } },
   { name: "server_info", description: "The AGPL §13 source offer: this server's name, version, licence, source repository and the COMMIT IT IS RUNNING. Callable by every session kind — the offer is owed to whoever interacts with the service. Reads no run and no account data.", inputSchema: { type: "object", properties: {} } },
   { name: "list_outbox_events", description: "Integrator discovery read (docs/DELIVERY.md): every pending outbox event — delivered markers plus the self-contained run-failed / intake-rejected / duplicate-skipped / late-bind-ack packets. Route each, then mark_sent (delivered) or ack_event (the rest).", inputSchema: { type: "object", properties: {} } },
   { name: "get_delivery_packet", description: "The run's send payload: _driver/delivery.json (subject, recipient routing, verbatim emailBodyHtml, whatsapp line) and/or failure.json, plus sendPending/.sent state. NOT exposed to client tokens.", inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] } },
@@ -851,6 +851,16 @@ export function attachHandlers(server, { scope = { kind: "ops", runId: null }, l
     let authedArgs;
     try { authedArgs = authorize(scope, name, args); }
     catch (e) { log(`authz deny ${name} [${scope.kind}]: ${e.message}`); return { isError: true, content: [{ type: "text", text: `FORBIDDEN (${name}): ${e.message}` }] }; }
+    // THE LISTING IS THE WALL. A tool this session's audience is not shown is one it cannot call: this
+    // used to filter only the listing, and a hidden tool called by name ran anyway once authorize()
+    // passed it. That is how an ops token reached what_if_run over HTTP, where the listing hides it and
+    // the engine starts. After authorize(), so a caller it already refuses keeps the refusal it names;
+    // this catches only what it lets through. Same answer as a name that does not exist, because to this
+    // session it does not.
+    if (!allow(name)) {
+      log(`listing deny ${name} [${scope.kind}${local ? "" : ", http"}]: not offered to this session`);
+      return { isError: true, content: [{ type: "text", text: `unknown tool "${name}"` }] };
+    }
     // ACCOUNT GATE (GRANTS, INSTALL.md §8): a run-addressed call from an account-scoped session must
     // target a run inside the grant. Enforced BEFORE dispatch so a denied run leaks nothing — not even
     // its existence (the deny message names the account, never the run's contents).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.3",
+  "version": "0.4.0-beta.1",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/dist/assets/{index-GBbbyQxc.js → index-D_O_55vK.js}

@@ -11865,6 +11865,7 @@ var api = {
 		accountNames: Object.fromEntries(Object.entries(asRecord(b["accountNames"])).filter(([, v]) => typeof v === "string" && v)),
 		accountFacts: Object.fromEntries(Object.entries(asRecord(b["accountFacts"])).map(([k, v]) => [k, asCompanyFacts(v)])),
 		concurrentRuns: asNumber(b["concurrentRuns"]),
+		houseMarketplaces: asStrings(b["houseMarketplaces"]),
 		engineMode: b["engineMode"] === "demo" ? "demo" : b["engineMode"] === "engine-unproven" ? "engine-unproven" : null,
 		engineProgramDisputed: b["engineProgramDisputed"] === true ? true : b["engineProgramDisputed"] === false ? false : null,
 		setupRoute: b["setupRoute"] === "packaged" ? "packaged" : b["setupRoute"] === "checkout" ? "checkout" : null,
@@ -21701,11 +21702,14 @@ var PROFILE_FIELDS = [
 		label: "Marketplaces",
 		kind: "lines",
 		group: "defaults",
+		picker: "marketplaces",
+		clearToEmptyList: true,
 		item: {
 			ok: (e) => {
 				const d = e.trim().toLowerCase();
 				return d !== "web" && !/\s/.test(d) && /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/.test(d);
 			},
+			strict: true,
 			expected: "a bare store domain like amazon.com"
 		},
 		hint: "One per line. A project can add to this list; it can never remove one."
@@ -21752,7 +21756,10 @@ var PROJECT_EDITABLE = new Set([
 	"industry",
 	"defaultProduct"
 ]);
-var projectFields = () => PROFILE_FIELDS.filter((f) => PROJECT_EDITABLE.has(rootKey(f)) && !f.customerOnly);
+var projectFields = () => PROFILE_FIELDS.filter((f) => PROJECT_EDITABLE.has(rootKey(f)) && !f.customerOnly).map((f) => f.clearToEmptyList ? {
+	...f,
+	clearToEmptyList: false
+} : f);
 var choiceLabel = (spec, value) => spec.choices?.find((c) => c.value === value)?.label ?? null;
 function depthChoices(products) {
 	return products.map((l) => {
@@ -21800,6 +21807,10 @@ function applyField(draft, spec, raw) {
 	const next = { ...draft };
 	const trimmed = raw.trim();
 	if (!trimmed) {
+		if (spec.clearToEmptyList) {
+			next[spec.key] = [];
+			return next;
+		}
 		if (spec.clearWith !== void 0) {
 			next[spec.key] = spec.clearWith;
 			return next;
@@ -21947,7 +21958,7 @@ var suggestionStyle = {
 	background: "var(--surface-raised)",
 	color: "var(--text-muted)"
 };
-function FieldPicker({ spec, value, onChange }) {
+function FieldPicker({ spec, value, onChange, suggestions = [] }) {
 	const [query, setQuery] = (0, import_react.useState)("");
 	const addId = (0, import_react.useId)();
 	const addBox = (0, import_react.useRef)(null);
@@ -22026,7 +22037,43 @@ function FieldPicker({ spec, value, onChange }) {
 			})]
 		});
 	}
-	const suggestions = matchTerritoriesIn(TERRITORIES, query, chosen, 8);
+	if (spec.picker === "marketplaces") {
+		const have = new Set(chosen.map((c) => c.trim().toLowerCase()));
+		const offered = suggestions.filter((d) => !have.has(d.trim().toLowerCase()));
+		return (0, import_jsx_runtime.jsxs)("div", {
+			style: { marginTop: 6 },
+			children: [offered.length ? (0, import_jsx_runtime.jsx)("div", {
+				style: {
+					display: "flex",
+					flexWrap: "wrap",
+					gap: 4
+				},
+				children: offered.map((d) => (0, import_jsx_runtime.jsxs)("button", {
+					type: "button",
+					onClick: () => toggle(d),
+					style: suggestionStyle,
+					children: ["+ ", d]
+				}, d))
+			}) : null, chosen.length ? (0, import_jsx_runtime.jsx)("div", {
+				className: "chip-row",
+				style: { marginTop: 8 },
+				children: chosen.map((d) => (0, import_jsx_runtime.jsxs)("span", {
+					className: "chip chip-own",
+					children: [d, (0, import_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: "chip-x",
+						onClick: () => toggle(d),
+						"aria-label": `Remove ${d}`,
+						children: (0, import_jsx_runtime.jsx)(Icon, {
+							name: "x",
+							size: 13
+						})
+					})]
+				}, d))
+			}) : null]
+		});
+	}
+	const found = matchTerritoriesIn(TERRITORIES, query, chosen, 8);
 	return (0, import_jsx_runtime.jsxs)("div", {
 		style: { marginTop: 6 },
 		children: [
@@ -22046,14 +22093,14 @@ function FieldPicker({ spec, value, onChange }) {
 					fontFamily: "inherit"
 				}
 			}),
-			suggestions.length ? (0, import_jsx_runtime.jsx)("div", {
+			found.length ? (0, import_jsx_runtime.jsx)("div", {
 				style: {
 					display: "flex",
 					flexWrap: "wrap",
 					gap: 4,
 					marginTop: 5
 				},
-				children: suggestions.map((t) => (0, import_jsx_runtime.jsxs)("button", {
+				children: found.map((t) => (0, import_jsx_runtime.jsxs)("button", {
 					type: "button",
 					onClick: () => {
 						toggle(t);
@@ -22092,7 +22139,7 @@ function FieldTag({ tag }) {
 		children: tag
 	});
 }
-function Field({ spec, value, choices, onChange }) {
+function Field({ spec, value, choices, onChange, suggestions }) {
 	const picker = spec.kind === "choice" || spec.kind === "boolean";
 	const multi = spec.kind === "lines" || spec.kind === "prose";
 	const classes = spec.picker === "classes";
@@ -22138,7 +22185,8 @@ function Field({ spec, value, choices, onChange }) {
 			(0, import_jsx_runtime.jsx)(FieldPicker, {
 				spec,
 				value,
-				onChange
+				onChange,
+				...suggestions ? { suggestions } : {}
 			})
 		]
 	});
@@ -22188,7 +22236,7 @@ function NewCompany({ ctx }) {
 	const key = derivedKey || (keyTyped ?? "");
 	useUnsaved((Boolean(typedName) || Object.keys(state.edits).length > 0) && !result);
 	const refusedEntries = specs().flatMap((spec) => {
-		if (!spec.item?.strict) return [];
+		if (!spec.item?.strict || spec.key === "platforms") return [];
 		const raw = boxValue(state, spec);
 		if (!raw.trim()) return [];
 		return parseLines(raw, spec.commaSeparated ?? false).filter((e) => !spec.item.ok(e));
@@ -22319,6 +22367,7 @@ function NewCompany({ ctx }) {
 								spec,
 								value: spec.key === "selfExclusionOwners" && !namesTouched ? typedName : boxValue(state, spec),
 								choices: null,
+								suggestions: ctx.me.houseMarketplaces,
 								onChange: (v) => {
 									if (spec.key === "selfExclusionOwners") setNamesTouched(true);
 									setState((st) => typeField(st, spec, v));
@@ -23629,7 +23678,8 @@ function Profile({ ctx }) {
 										edits
 									}, spec),
 									choices: spec.key === "defaultProduct" ? productChoices : spec.choices ?? null,
-									onChange: (v) => edit(spec, v)
+									onChange: (v) => edit(spec, v),
+									suggestions: ctx.me.houseMarketplaces
 								}),
 								spec.key === "defaultJurisdictions" ? (0, import_jsx_runtime.jsx)(UnsearchableTerritories, { derived: loaded.derived }) : null,
 								spec.key === "defaultProduct" && coverageOf(loaded.derived) ? (0, import_jsx_runtime.jsxs)("details", {

package/portal-ui/dist/index.html

@@ -49,7 +49,7 @@
     -->
     <link rel="preconnect" href="https://api.fontshare.com" crossorigin />
     <link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/portal/assets/index-GBbbyQxc.js"></script>
+    <script type="module" crossorigin src="/portal/assets/index-D_O_55vK.js"></script>
     <link rel="stylesheet" crossorigin href="/portal/assets/index-5CCwiJG7.css">
   </head>
   <body>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.3",
+  "version": "0.4.0-beta.1",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/_shared/README.md

@@ -21,7 +21,7 @@ documents both: `countProbe` (`"endpoint"` / `"cheap"` / `"none"`) says where a
 | `transport-guard.mjs` | Converts a network REJECTION into the tool-error shape at the dependency seam, so one timeout degrades one query rather than killing the stage. |
 | `result-shape.mjs` | Declares the neutral tools' result vocabulary. Imported by its gate test and deliberately by no core — a tool result is the model's prompt surface. |
 | `script-form.mjs` | Which script a term is written in, and whether the active provider's index holds that form of it. |
-| `term-shape.mjs` | Whether a string is a searchable mark term and agrees with its predicate (`{ predicate: "exact", term: "TIKI*" }` is a silent clean). |
+| `term-shape.mjs` | Whether a string is a searchable mark term and agrees with its predicate (`{ predicate: "exact", term: "WAVO*" }` is a silent clean). |
 | `territory-codes.mjs` | Display name → ISO 3166 / WIPO ST.3 code. `""` means worldwide, `null` means unknown — and never goes to the wire. |
 | `provider-text.mjs` | Clips a vendor message from the MIDDLE, because the word that classifies a refusal sits at the end of the sentence. |
 | `test/` | Twelve files, provider-agnostic by design — several drive every adapter's real code rather than fixtures of what we believe it returns. |