clearotron 0.4.0 → 0.4.1-beta.1

package/THIRD-PARTY-NOTICES.md

@@ -110,7 +110,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @modelcontextprotocol/sdk@1.30.1
+## @modelcontextprotocol/sdk@1.32.1
 
 - **Licence declared:** `MIT`
 - **Repository:** https://github.com/modelcontextprotocol/typescript-sdk
@@ -4896,7 +4896,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.**
 ```
 
-## proxy-addr@2.0.7
+## proxy-addr@2.0.8
 
 - **Licence declared:** `MIT`
 - **Repository:** jshttp/proxy-addr

package/bin/README.md

@@ -20,7 +20,7 @@ and is what you want when you are working in this tree.
 | `signa-sync.mjs` | — | `node bin/signa-sync.mjs` | One vendor read (`GET /v1/offices`, paged). Needs `SIGNA_API_KEY`. |
 
 `example.mjs` replays `demo` through the ordinary publisher into `~/trademark-demo/pool` and
-serves it on `127.0.0.1:18900`. Every path the demo pool could collide with is checked by realpath and by
+serves it on `127.0.0.1:18860`. Every path the demo pool could collide with is checked by realpath and by
 containment before anything is written, because a demo runs on deployed machines too.
 
 `onboard.mjs` validates each answer through the door the engine itself uses before it persists anything,

package/bin/clearotron.mjs

@@ -65,6 +65,7 @@ export const VERBS = {
   passphrase: ["bin/passphrase.mjs"],
   sync:    ["bin/uspto-sync.mjs"],
   update:  ["bin/update.mjs"],
+  mcp:     ["bin/mcp.mjs"],
 };
 
 export const SUMMARY = {
@@ -87,6 +88,7 @@ export const SUMMARY = {
   passphrase: "report or RESET the portal's local sign-in — the recovery for a lost passphrase",
   sync:    "build or update the free US register index (a large download, and hours of ingest)",
   update:  "bring this install up to date — and REFUSE to do it over the top of your own configuration",
+  mcp:     "serve this install's searches to an assistant over MCP, or the demo's where there is no install",
 };
 
 /**

package/bin/mcp.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// mcp.mjs — `clearotron mcp`: the MCP server over stdio, started from the package itself.
+//
+// An install's own connect lines run the server from that install's copy (shared/stdio-connect.mjs), so
+// an assistant never keeps an old server after an upgrade, and they stay as they are. This verb is for a
+// machine with no install, and for a listing that launches the published package with `npx`.
+//
+// WHICH RUNS IT READS. An install's, wherever one is found; the demo's four sample runs where none is.
+// Standard output belongs to the protocol from its first byte, so nothing here prints to it.
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { parseEnv } from "node:util";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
+import { demoMode } from "../mcp-server/demo-mode.mjs";
+
+/** The two settings the install's own connect lines hand the server: where runs are, and where reports are. */
+export const INSTALL_FOLDERS = Object.freeze(["CLEAROTRON_WORK_DIR", "CLEAROTRON_REPORTS_DIR"]);
+
+/** The demo's own base, and where it keeps its runs and its access log: the layout `installPaths` gives it. */
+export const demoBase = (home = homedir()) => join(home, "trademark-demo");
+export const demoWorkspace = (home = homedir()) => join(demoBase(home), "workspace");
+
+/**
+ * WHAT COUNTS AS AN INSTALL, and so whether this server reads an install's runs or the demo's. PURE.
+ *
+ * An install is any one of these:
+ *   - a work folder or a reports folder named in this process's environment, in the settings file a
+ *     packaged install writes (`~/.config/clearotron/.env`), or in the file a background install's
+ *     services read (`~/.env`);
+ *   - either of those files carrying any Clearotron setting at all, which is an install configured and
+ *     not yet pointed at its folders: the server then reads its default and names what is missing;
+ *   - the default workspace, `~/trademark/workspace`, on disk.
+ * The demo writes neither file and keeps its runs under its own base, so a machine that has only run the
+ * demo still reads as no install. An install never gets the demo: a misconfigured one is refused by name.
+ *
+ * Returns the folders to hand the server (only what is set, and never over the environment's own value),
+ * or `demo: true` where there is no install.
+ */
+export function mcpTarget({ env = process.env, home = homedir(), exists = existsSync, read = (p) => readFileSync(p, "utf8") } = {}) {
+  const parsed = (p) => { try { return parseEnv(read(p)); } catch { return null; } };
+  const settings = parsed(join(home, ".config", "clearotron", ".env"));
+  const services = parsed(join(home, ".env"));
+  const set = (v) => (typeof v === "string" && v.trim() ? v.trim() : null);
+  const folders = {};
+  for (const k of INSTALL_FOLDERS) {
+    const v = set(env[k]) ?? set(settings?.[k]) ?? set(services?.[k]);
+    if (v) folders[k] = v;
+  }
+  const configures = (file) => Boolean(file) && Object.keys(file).some((k) => /^(CLEAROTRON|TRADEMARK|PORTAL)_/.test(k));
+  const install = Object.keys(folders).length > 0 || configures(settings) || configures(services)
+    || exists(join(home, "trademark", "workspace"));
+  return install ? { demo: false, env: folders } : { demo: true, env: {} };
+}
+
+async function main() {
+  const target = mcpTarget();
+  if (target.demo) {
+    // The four sample runs, copied where the connector walks, under the demo's own base: nothing is
+    // written anywhere an install reads (driver/demo-container.mjs).
+    const { seedDemoRuns } = await import("../driver/demo-container.mjs");
+    const workspace = demoWorkspace();
+    seedDemoRuns({ workspace, examplesDir: join(import.meta.dirname, "..", "demo") });
+    process.env.CLEAROTRON_WORK_DIR = workspace;
+    // The door's access log too, which would otherwise open the install's own telemetry folder.
+    if (!set(process.env.TRADEMARK_MCP_AUDIT_LOG)) process.env.TRADEMARK_MCP_AUDIT_LOG = join(demoBase(), "telemetry", "trademark-mcp-access.jsonl");
+    demoMode.on = true;
+  } else {
+    for (const [k, v] of Object.entries(target.env)) if (!set(process.env[k])) process.env[k] = v;
+  }
+  // The server starts through the entry that refuses an old Node in one plain line before it loads.
+  await import("../mcp-server/serve.mjs");
+}
+
+const set = (v) => typeof v === "string" && v.trim() !== "";
+
+if (isEntrypoint(import.meta.url)) await main();

package/bin/start.mjs

@@ -2445,6 +2445,18 @@ if (isMain) {
   const clientDoor = adoptedClientDoor
     ? null
     : start("the client door", "mcp-server/http-server-client.mjs", envs.client, { fatal: false });
+  // ── THE BANNER NAMES THIS DOOR ONLY ONCE IT ANSWERS ─────────────────────────────────────────────────
+  //
+  // The engine door and the portal are each awaited above before anything is printed. This door was
+  // not: the banner below was composed the moment it was spawned, while it was still loading, and
+  // announced an address that refused connections. Measured 2026-10-09, in a container with no network
+  // running as root and on a host as a normal user: a request sent as the banner printed got no
+  // connection, and the door's first answer came about half a second later. Its own output said nothing
+  // was wrong, because nothing was; it had not finished starting.
+  //
+  // Same probe and same budget as the other two, and non-fatal like the door itself. A door that exits,
+  // or does not answer within the budget, takes the NOT RUNNING branch below and the portal keeps serving.
+  const clientDoorAnswered = clientDoor ? await healthy(`http://${HOST}:${ports.client}/healthz`, clientDoor) : false;
 
   // ── 6. one URL ─────────────────────────────────────────────────────────────────────────────────────
 
@@ -2471,7 +2483,8 @@ if (isMain) {
   // AN ADOPTED DOOR IS RUNNING. Without this the banner reported "NOT RUNNING …
   // its output above says why" about a door that is up and serving, and pointed the reader at output
   // that does not exist — the one sentence on this screen a reader would act on, and false.
-  const doorRunning = adoptedClientDoor || clientDoor?.child?.exitCode === null;
+  // AND A SPAWNED DOOR IS RUNNING ONLY ONCE IT HAS ANSWERED: alive is not listening (see the probe above).
+  const doorRunning = adoptedClientDoor || (clientDoor?.child?.exitCode === null && clientDoorAnswered);
   if (doorRunning) {
     say(`  Client door  http://${HOST}:${ports.client}/mcp   — a client's assistant connects here.`);
     if (adoptedClientDoor)

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "9b8ab0f275a16e9b586425c3574c94b5974e225b",
-  "version": "0.4.0"
+  "commit": "0ac7d328864dbb4446ea2dd472f64acff14b7a4f",
+  "version": "0.4.1-beta.1"
 }

package/demo/README.md

@@ -16,7 +16,7 @@ carries no `report.md` at all, because for that lane the markdown is an output o
 an input to it.
 
 Each directory is named by the product that produced it — the id in the run's own frozen search policy,
-not a label chosen afterwards. `clearotron demo` replays the first; `clearotron demo --product <id>`
+not a label chosen afterwards. `clearotron demo` replays all four; `clearotron demo --product <id>`
 replays a named one; `clearotron demo --run-dir <dir>` replays any frozen run from anywhere.
 
 ## The marks are invented; the data behind them is real

package/docs/SECURITY-OWASP.md

@@ -45,10 +45,11 @@ shows the engine's internals to a company's people.
 **What Clearotron does.** Every read passes one authorization check, and a person sees only what their
 grant names. A key bound to one run reads that run and writes nothing. The copy of a report a company
 receives drops the staff-only notes. No real company's data is in this repository; run data lives
-in folders the operator owns. CI scans the tree and the built bundle for secrets.
+in folders the operator owns. CI scans the tree and the built bundle for secrets. A report published
+from 0.4.0 on carries its fonts inside itself, and opening it contacts no other server.
 
 **Where.** [SECURITY.md](SECURITY.md) (the access model), `shared/scope.mjs`, `driver/portal-report.mjs`,
-`.gitleaks.toml`, `.github/workflows/ci.yml`.
+`.gitleaks.toml`, `.github/workflows/ci.yml`, `scripts/report-offline-render-check.mjs`.
 
 **Not covered.** A company's clearances are kept until the operator deletes them: Clearotron sets no
 retention period, because how long they are held is the operator's policy.
@@ -57,14 +58,15 @@ retention period, because how long they are held is the operator's policy.
 
 **Here.** A compromised npm package, GitHub Action or engine program.
 
-**What Clearotron does.** Dependabot updates the npm packages and the GitHub Actions. Each release is
-published to npm through trusted publishing, with provenance that ties the package to the commit and the
-build that produced it. A stable release is not published while a code-scanning alert is open. Setup
+**What Clearotron does.** Dependabot updates the npm packages and the GitHub Actions. Every GitHub Action is pinned to a commit
+hash. Each release is published to npm through trusted publishing, with provenance that ties the package
+to the commit and the build that produced it. Each release carries a software bill of materials. On an install from a git
+checkout, `clearotron update` installs with install scripts off. A stable release is not published while a code-scanning alert is open. Setup
 installs, and `clearotron doctor` accepts, only an engine program at or above the version this release
 needs.
 
-**Where.** `.github/dependabot.yml`, `.github/workflows/release.yml`,
-`scripts/release-code-scanning-check.mjs`, `driver/driver.config.mjs` (`ENGINE_BINARIES`, each program's
+**Where.** `.github/dependabot.yml`, `.github/workflows/`, `.github/workflows/release.yml`,
+`scripts/release-sbom.mjs`, `bin/update.mjs`, `scripts/release-code-scanning-check.mjs`, `driver/driver.config.mjs` (`ENGINE_BINARIES`, each program's
 `floor`).
 
 ### LLM04:2025 Data and Model Poisoning
@@ -99,12 +101,14 @@ The common-law search asks the research service to run a search program, on that
 
 **What Clearotron does.** Tools are granted per stage, by name. The case-law stage is the exception: it is granted every tool its two case-law services offer. A Claude
 stage is offered no command tool.
-Register searches beyond the fixed plan go through a proposal that code checks and runs. A key issued for
-automation can be limited to named actions. A what-if requested by a company's people is queued for a
+Register searches beyond the fixed plan go through a proposal that code checks and runs. A new key issued for
+automation must name the actions it may take; keys issued before that rule keep working, and each use of
+one is recorded. No key for automation reaches a what-if over the network. A what-if requested by a company's people is queued for a
 separate process rather than run by the door that received it.
 
 **Where.** `driver/engine/mcp/gather-config.mjs`, `driver/engine/anthropic-agent.mjs`,
-`driver/engine/mcp/supplemental.mjs`, `shared/scope.mjs`, `driver/whatif-worker.mjs`.
+`driver/engine/mcp/supplemental.mjs`, `shared/scope.mjs`, `driver/whatif-worker.mjs`,
+`mcp-server/mint-token.mjs`, `mcp-server/server.mjs`.
 
 **Not covered.** As ASI02: the Claude program also offers a stage built-in tools that act without asking.
 
@@ -189,7 +193,7 @@ remove them.
 **What Clearotron does.** The AI program starts with a named list of settings, and the key that signs
 access keys is not on it. The worker that starts the AI program does not hold that key either, whether
 the install runs in a terminal or under systemd. Access keys are scoped to a run, a company or named
-actions, and one check enforces the scope. On Claude, a stage's file tools can read nothing outside its run folder, its
+actions, and one check enforces the scope. A new key for automation must name its actions. On Claude, a stage's file tools can read nothing outside its run folder, its
 instruction folders and any folder the machine's own Claude settings add. On Codex with its sandbox on, a stage's commands can read nothing outside its run folder, its instruction folders, the temporary
 folders, and the system and program files a command needs to run.
 
@@ -276,10 +280,12 @@ could not run is listed in the report.
 
 **What Clearotron does.** No agent outlives its stage. Each stage is one process under a watchdog and a
 hard time limit, and the driver stops its whole process group. The driver records every program it
-starts. On the Claude engine a stage cannot write into the instructions it runs from.
+starts. On the Claude engine a stage cannot write into the instructions it runs from. The systemd units
+an install can run in the background start with `NoNewPrivileges`, so nothing a stage starts there can
+gain more than the install's account holds.
 
 **Where.** `driver/engine/anthropic-agent.mjs`, `driver/engine/common.mjs`,
-`driver/engine/child-record.mjs`, `driver/engine/deny-authority-write.mjs`.
+`driver/engine/child-record.mjs`, `driver/engine/deny-authority-write.mjs`, `driver/systemd/`.
 
 **Not covered.** As LLM04: on Codex, no check refuses a stage's write inside its run folder.
 
@@ -296,3 +302,5 @@ Measured on 2026-09-23 with the GitHub API.
 | Private vulnerability reporting | On |
 | npm provenance | Every release, through trusted publishing |
 | Required checks on `main` | Six; force pushes and branch deletion refused |
+| Actions pinned to a commit hash | All 42, read from the workflow files on 2026-09-24 |
+| Software bill of materials | CycloneDX, attached to every release, read from the release workflow on 2026-09-24 |

package/docs/SECURITY.md

@@ -12,7 +12,7 @@ Each risk on OWASP's two lists for AI systems, and what Clearotron does about it
 
 | Surface | Trust | Guard |
 |---|---|---|
-| stdio MCP (`mcp-server/server.mjs`) | local/full ("ops") | OS user boundary — run it AS the operator account; it is the only surface on which `what_if_run` EXECUTES (`visibleTools` keeps what-if out of the HTTP listing for ops, but the CallTool chokepoint gates on `authorize()` alone, which admits it for any ops token not `--verbs`-scoped) |
+| stdio MCP (`mcp-server/server.mjs`) | local/full ("ops") | OS user boundary — run it AS the operator account; it is the only surface on which `what_if_run` EXECUTES (`visibleTools` keeps what-if out of the HTTP listing for ops, and the CallTool chokepoint refuses any tool the listing hides, so no ops token reaches it over HTTP) |
 | Client MCP (`mcp-server/http-server-client.mjs`) | a company's signed-in person / their access key | `what_if_run` from an `account` principal ENQUEUES rather than executes (ruling 2026-08-27) — it never imports the engine, and `driver/whatif-worker.mjs` spawns the sandbox from an OS service process. A confirmation token is unsigned, so the call must ALSO name its `runId`: the grant check keys on it, and `whatIfEnqueue` refuses a token naming a different run. The `model` argument is refused on this face. |
 | HTTP MCP (`mcp-server/http-server.mjs`) | authenticated remote | auth-BEFORE-data; fail-closed construction; inner scoped tokens |
 | Run-bound keys | a report recipient an operator issues one to | a `user` key from `mint-token.mjs`, read-only and bound to one run; the plain-language report tools (`clientSafe`) only |
@@ -98,9 +98,9 @@ with access to everything.
   on (`get_coverage`, `search`, `diff_artifact`, `run_changes`, what-if), which are denied by the
   default that an undecided tool is denied.
 - HMAC-signed tokens (`v1.<payload>.<sig>`, node:crypto only). `authorize()` is the single
-  enforcement point for every tool call; `visibleTools()` additionally hides what a session may not
-  call — but it is hygiene on the tool LISTING, not a second gate, and it is the only thing that
-  reads `local`.
+  enforcement point for every tool call; `visibleTools()` decides what a session is offered, and a
+  tool it hides is refused by name at the call, after `authorize()`. `authorize()` never sees `local`,
+  and `visibleTools()` is the only per-call gate that uses it.
 - **User tokens cannot**: enumerate runs, cross to another run (explicit mismatching runId refused;
   omitted runId pinned), reach any write/spend tool, or read internal artifacts — `read_artifact`
   is name-gated to the report alone (`USER_ARTIFACTS`), and `list_findings` to the curated
@@ -110,13 +110,13 @@ with access to everything.
   rides inside a delivered PDF and can be forwarded to anyone, and the ruling was about people the
   operator enrolled. Both sets are gated at the read_artifact tool AND at the Resources surface
   (`resources/list` / `resources/read`), kind for kind — two doors to the same bytes, one rule.
-- **Ops tokens are least-privilege**: an optional `verbs[]` allowlist restricts write tools per
-  principal (an intake connector physically cannot `stop_run`). `what_if_*` is filtered out of the
-  HTTP tool LISTING for every OPS scope (`visibleTools`, keyed on `local` — the `local` test governs
-  the ops branch only, and an `account` principal returns above it). That is hygiene, not a wall:
-  `authorize()` never sees `local` and treats what-if as an ordinary ops write verb, so an ops token
-  minted without `--verbs` can still call it over HTTP — which is why every HTTP ops token should be
-  minted verb-scoped.
+- **Ops tokens are least-privilege**: a new ops token must name its `verbs[]`, the write tools it may
+  call (an intake connector physically cannot `stop_run`), and `mint-token` refuses one without
+  `--verbs`. Tokens issued before that rule keep working, and the audit line marks every call they
+  make. `what_if_plan` and `what_if_run` are left out of the HTTP tool listing for every ops scope
+  (`visibleTools`, keyed on `local`), and a tool the listing hides is refused at the call, so no ops
+  token plans or runs a what-if over HTTP. An `account` principal returns above that branch: its
+  what-if is queued for a separate process, never run by the door.
 
 ## Token lifecycle
 
@@ -127,15 +127,21 @@ what the mechanism guarantees.*
   principal in every audit line; the `jti` printed at mint time is the revocation handle). Three other callers share the same `mintToken`: `clearotron start` mints the portal's verb-scoped,
 company-capped ops token in memory at every start, and neither prints nor stores it; `clearotron connect`
 and the portal's connect screen each mint a person's key for their own assistant.
-- **Revocation**: denylist file checked on every verification; missing file = nothing revoked (the
-  denylist can never take all auth down). **Rotation**: two-secret window, flag-day-free.
+- **Revocation**: a denylist file is checked on every verification, always. With
+  `TRADEMARK_MCP_TOKEN_DENYLIST` unset it is `~/.config/clearotron/token-denylist`, the file every revoker
+  writes in that case, and that file being absent means nothing has been revoked. A list named in the
+  setting that is missing or unreadable, or a default list that exists but cannot be read, refuses every
+  key. **Rotation**: two-secret window, flag-day-free.
 - **Rate limits**: per-identity bucket on every request plus a separate lower per-principal bucket
   for ops sessions.
 
 ## Audit
 
 Every HTTP tool call appends one line to an append-only JSONL (`TRADEMARK_MCP_AUDIT_LOG`) when the call
-finishes: `{ts, email, sub, method, tool, runId, status, door}`, where `status` is the outcome. It is
+finishes: `{ts, email, sub, kind, method, tool, runId, status, door}`, where `status` is the outcome, plus `query` (its
+first 120 characters) on a search, `uri` on a resource read and `transport` on the local route, and for an
+ops token `namesVerbs`, which says whether the token names its tools (never which tools, and never the
+token). It is
 written after scope resolution, so it names the principal. A request refused before any tool runs is
 written too, with the status `refused`. Writing it is best-effort and never blocks a request.
 

package/docs/architecture/04-configuration-reference.md

@@ -156,7 +156,8 @@ the attempt row records the id the program reports it served.
 **The CLI must be new enough for the model.** Each release carries its own list of accepted models,
 and one that predates a model refuses it outright while the tier alias goes on serving the previous
 generation — a 400 at the first turn, or a run that quietly used an older model. Setup installs
-`2.1.280` or newer for this reason; a copy already on the machine is used as it is, so `doctor`'s
+`2.1.293` or newer for this reason, the first release whose `haiku` reaches Claude Haiku 5.5 (`opus` and
+`sonnet` reached 5.5 from `2.1.284`); a copy already on the machine is used as it is, so `doctor`'s
 version is the one to read before assuming which model a tier reaches.
 
 **Anything else throws.** There is no regex fall-through to sonnet and no cross-provider
@@ -190,7 +191,7 @@ timeout shot, warm patch, backoff), the lane-wedge re-dispatch, and the rate-lim
 | `CLEAROTRON_AI_BILLING` | `subscription` (default) \| `api-key` \| `cloud` | Billing mode for the selected engine. ONE variable for both, and only the LIVE engine's setting is read — it fills each engine's billing knob, and the engine that is not selected is never consulted. **`anthropic-agent`:** subscription **deletes `ANTHROPIC_API_KEY` from the child env** so `claude -p` uses OAuth subscription credentials (a present key would override them); `api-key` keeps the key — the scale setting and standing fallback; **`cloud`** bills Claude per use through the reader's own cloud account, named by the Claude program's own switch — `CLAUDE_CODE_USE_VERTEX`, `CLAUDE_CODE_USE_FOUNDRY` or `CLAUDE_CODE_USE_BEDROCK`, or `ANTHROPIC_BASE_URL` alone for a gateway (see the credentials table below) — and deletes `ANTHROPIC_API_KEY` as subscription does. **`openai-agent`:** subscription seeds `auth.json` into the per-run `CODEX_HOME` from `CLEAROTRON_OPENAI_AUTH_FILE` (default `~/.codex/auth.json`) and strips API keys; `api-key` keeps `CODEX_API_KEY`; `cloud` is refused. **Fail-loud, never a guess, never the subscription in its place:** `api-key` with no `ANTHROPIC_API_KEY` / `CODEX_API_KEY` throws; on `anthropic-agent`, `cloud` with two switches on, or with none and no `ANTHROPIC_BASE_URL`, throws, and so does a switch left on under `subscription` or `api-key`, because the program bills that cloud whatever this says; a value that is none of the three throws on both engines. `clearotron start` and `clearotron doctor` report each refusal against the settings the services read, naming a value that is not a billing mode by its setting and never quoting it, and the runner refuses the search when it is ordered, before anything is spent. The resolved mode is stamped on every stage telemetry row (`engine`, `authMode`, `apiBilled`, and `cloud`, null when no cloud bills), and the attempt row also carries `providerReported`, the program's own word for who served the turn. |
 | `CLEAROTRON_CLAUDE_PATH` · `CLEAROTRON_CODEX_PATH` | `claude` / `codex` on `PATH`, then the copy Clearotron installed | The engine binary to spawn, ONE PER ENGINE: `CLEAROTRON_CLAUDE_PATH` under `anthropic-agent`, `CLEAROTRON_CODEX_PATH` under `openai-agent`. Only the live engine's is read, and a machine that runs both sets both — they were one variable until it met a machine needing two different paths. A path set here must be **absolute**: stage subprocesses run with cwd set to the run directory, so a relative path does not resolve there, and `clearotron doctor` refuses one. **Unset**, or set to the bare word `claude` / `codex` (which means the same), the engine uses the program on `PATH` when the machine has one, and otherwise the copy Clearotron installed in `~/.local/share/clearotron/engines`: `clearotron install` offers to put the chosen engine's program there (`@anthropic-ai/claude-code` or `@openai/codex`, this platform's build only), and `clearotron update` refreshes it. Nothing is bundled into the package. A value naming anything else is used as given and never falls back. `clearotron doctor` says which copy it found, and its version when npm installed that copy. |
 | `CLEAROTRON_OPENAI_AUTH_FILE` | `~/.codex/auth.json` | The credentials file seeded into the per-run `CODEX_HOME` under subscription billing. Was exempted from the August 2026 rename as an `openai-agent` internal rather than an install-surface name; a decision of 2026-09-04 **reversed that exemption** and renamed the whole namespace, so it carries the house prefix like everything else. One spelling, no exceptions. |
-| `CLEAROTRON_OPENAI_MODEL_JUDGMENT` / `CLEAROTRON_OPENAI_MODEL_SWEEP` / `CLEAROTRON_OPENAI_MODEL_CHEAP` | `gpt-5.6-sol` / `gpt-5.6-terra` / `gpt-5.6-luna`. | Maps the driver's abstract `opus`/`sonnet`/`haiku` tiers onto the codex ladder, the way the anthropic engine maps onto its own (ruling 2026-09-02, superseding the single-model mapping). A tier that cannot hold its stage contract announces itself at that stage — `missing:negative-results`, `no_coverage_status_row`, `named_band_missing` in `_driver/<stage>.jsonl` — not at delivery. |
+| `CLEAROTRON_OPENAI_MODEL_JUDGMENT` / `CLEAROTRON_OPENAI_MODEL_SWEEP` / `CLEAROTRON_OPENAI_MODEL_CHEAP` | `gpt-6.1-sol` / `gpt-6.1-sol` / `gpt-6-luna` (from 2026-10-09; before that `gpt-5.6-sol` / `gpt-5.6-terra` / `gpt-5.6-luna`). Codex `0.159.0` or newer is required on a ChatGPT sign-in: older releases refuse `gpt-6.1-sol` with a 400. | Maps the driver's abstract `opus`/`sonnet`/`haiku` tiers onto the codex ladder, the way the anthropic engine maps onto its own (ruling 2026-09-02, superseding the single-model mapping). A tier that cannot hold its stage contract announces itself at that stage — `missing:negative-results`, `no_coverage_status_row`, `named_band_missing` in `_driver/<stage>.jsonl` — not at delivery. |
 | ↳ why they are three, and what the old measurement still says | superseded 2026-09-02, not erased | The three defaulted to `sol` alone on a MEASUREMENT, never a placeholder: on 2026-08-11/12, with `SWEEP=gpt-5.6-terra` / `CHEAP=gpt-5.6-luna`, every codex clearance died on structural-output gates — `missing:negative-results`, `no_coverage_status_row`, `named_band_missing` — over 2 scenarios × 3 stage families, **byte-identically on retry**, so no retry budget rescued it. That measurement stands for the code and the codex CLI **of that date**, and it is why the judgment tier keeps `sol`. Three weeks of stage-contract work and several codex minor versions sit between it and the 2026-09-02 ruling that split the three. **The symptom to match against this cause is unchanged**: those same three gates, as a fail row in`_driver/<stage>.jsonl`, inside the first few dispatches of a clearance and identical on every retry — a model incapable of a contract is not flaky at it. It reads as an engine bug when the only fault is this configuration. A cheap-tier experiment still belongs in the three constants in `driver/engine/openai-agent.mjs` where a reviewer sees it, not in an untraceable env line. |
 | `CLEAROTRON_DATABASE` | **REQUIRED — no default.** `corsearch` \| `clarivate` \| `signa` \| `euipo` \| `uspto-local` \| `free-tier` | Active register provider — one per run, set in the environment the deploy carries, in every environment including production. There is **no default**: unset resolves to `null` and every use of it throws, so a run refuses at start rather than calling a vendor nobody chose (the removed `corsearch` fallback named a vendor the deployment did not choose). Three are paid global sweeps; `euipo` (EU) and `uspto-local` (US) are free single-office sources, and `free-tier` composes those two as one register. Choosing a free value makes every territory outside its coverage a disclosed *deferred* row. Unknown ids throw loudly, and the gather layer throws at stage time for any provider without a built MCP server. |
 | `CLEAROTRON_CODEX_SANDBOX_BYPASS` | unset | `1` runs `codex exec` with its own sandbox bypassed, for hosts where that sandbox cannot run (setup and `doctor --probe-engine` report it). It removes a defence: with it set, a stage's commands run with every permission of the account Clearotron runs as, not only in the run folder. Codex has no guard against a stage writing into the run's `_driver/` folder, with the sandbox or without it. Set it because the host forces it, never for convenience. |
@@ -300,7 +301,6 @@ because the rule is about what PRODUCT CODE reads, not about what a run reads.
 
 | Var | Default | Meaning |
 |---|---|---|
-| `DEMO_PORT` | `18900` | Port `npx clearotron demo` serves the replayed report on. `--port` overrides it. |
 | `CLEAROTRON_DEMO` | unset | `1` puts this install in the DEMO posture. **Ordering is real**: the four products are listed and orderable, the form, the plan and the confirmation are the product's own, and the confirmation resolves to a finished report that already exists rather than dispatching — no engine turn, no register call, no queue entry, no run directory (ruling 2026-08-31, superseding the greyed-control ruling of the same day). A product the demo carries no finished report for refuses and names which one. It also re-aims two boot warnings written for an operator of a real deployment at the visitor who is not one, from one place (`driver/demo-posture.mjs`). **Set by `npx clearotron demo`, not by an operator** — it is passed explicitly to the two processes that have a reason to know (the portal and the MCP door; the worker is not told, because a demo never queues anything for it to drain), and those run with `CLEAROTRON_NO_ENV_FILE=1`, so a stray `.env` can neither put a live install into demo mode nor take a demo out of one. Anything but the literal `1` is not a demo. Replaces `PORTAL_DEMO`, which named only one of the processes that has to know. |
 | `CLEAROTRON_TEST_FIXTURE_PROFILES` | unset | `1` makes the profile loader return the three suite fixtures, which are refused from every roster otherwise. Set by `scripts/test-run.mjs`, never by an operator; an explicit `includeTestFixtures` argument beats it. Effect class `harness`; the full contract is its row in `.env.example`. |
 | `CLEAROTRON_DEMO_PROFILES` | unset | `1` makes the profile loader return the bundled demo company, which a fresh install does not resolve (ruling 2026-09-08). Set by `clearotron demo`, `start --demo` and the suite runner, never by an operator. The gate is on the bundled layer, so a deployment's own configured store keeps its `demoData` companies either way. Effect class `harness`; the full contract is its row in `.env.example`. |

package/docs/architecture/05-config-governance.md

@@ -161,7 +161,7 @@ structural, or dev seam); [dev] = dev/test seam, never set in prod.
 `CLEAROTRON_AI` (anthropic-agent | openai-agent; default anthropic-agent), `CLEAROTRON_AI_BILLING`
 (subscription|api-key|cloud; cloud is Claude only), `CLEAROTRON_CODEX_PATH`,
 `CLEAROTRON_OPENAI_AUTH_FILE`, `CLEAROTRON_OPENAI_MODEL_JUDGMENT` / `CLEAROTRON_OPENAI_MODEL_SWEEP` /
-`CLEAROTRON_OPENAI_MODEL_CHEAP` (all gpt-5.6-sol),
+`CLEAROTRON_OPENAI_MODEL_CHEAP` (gpt-6.1-sol / gpt-6.1-sol / gpt-6-luna),
 `CLEAROTRON_CLAUDE_PATH` (claude on PATH, then the copy Clearotron installed),
 `CLEAROTRON_SYNTHESIS_MODEL` (opus), `CLEAROTRON_KNOCKOUT_MODEL` (opus),
 `CLEAROTRON_MAX_BUDGET_USD` (unset).

package/docs/architecture/06-operations-runbook.md

@@ -294,16 +294,17 @@ node mcp-server/mint-token.mjs --scope ops --sub <principal-name> \
 
 - `--sub` names the principal, and it rides into every audit line. Two integrations holding ops
   tokens are then distinguishable in the log; one shared token makes them permanently indistinguishable.
-- `--verbs` is a least-privilege allowlist of write tools. A connector minted without `stop_run`
+- `--verbs` is required for an ops token: it lists the write tools the token may call. A connector minted without `stop_run`
   cannot call it — the check sits at the one chokepoint every tool call passes, not in each tool.
 - `--accounts` caps the token to a set of company keys, so a trial integration can start demo
   searches and never a real company's.
 - The token is printed once and stored nowhere. Losing it means minting another.
 
 **Revoking one.** Every mint prints a `jti`. Write that line into the file named by
-`TRADEMARK_MCP_TOKEN_DENYLIST` (one `jti` per line, `#` comments allowed) and the next verification
-refuses the token. A **missing** denylist file means nothing is revoked, never everything — a denylist
-must not be able to take all authentication down.
+`TRADEMARK_MCP_TOKEN_DENYLIST`, or into `~/.config/clearotron/token-denylist` when the setting is unset
+(one `jti` per line, `#` comments allowed), and the next verification refuses the token. A named list
+that is missing or unreadable refuses every key, and so does a default list that exists but cannot be
+read. An absent default list means nothing has been revoked.
 
 **Rotating the signing secret.** Verification accepts `TRADEMARK_MCP_TOKEN_SECRET` or
 `TRADEMARK_MCP_TOKEN_SECRET_PREVIOUS`; minting always signs with the current one. Move the old value

package/docs/architecture/08-development-guide.md

@@ -10,7 +10,9 @@ How to work on the driver without breaking the properties that make it trustwort
 
 - **Node ≥ 22** (every workspace `package.json` declares it; CI pins 22.23.2). The repo is an npm
   workspace — `npm ci` at the root installs `driver`, `mcp-server`, `providers/oauth-mcp-bridge`
-  and `portal-ui` together. Production deploys install with `--omit=dev --ignore-scripts`.
+  and `portal-ui` together. An install from a git checkout updates with `npm ci --ignore-scripts` and
+  keeps development packages, because the portal is rebuilt from them. A packaged install updates
+  through `npm install --global`.
 - **Tests**: `npm test` in the driver dir runs the *contributor* tier
   (`scripts/test-run.mjs` → `scripts/test-fast.mjs` over `test/*.test.mjs`), which leaves out the
   slowest end-to-end files so a first run finishes in minutes. `npm run test:full` is the

package/docs/architecture/09-security-and-data.md

@@ -105,9 +105,12 @@ are no root units; everything is `systemd --user`.
     The API-key door is a fourth process (loopback :18812) with **no Access in front** — the trade is
     explicit: a mandatory key replaces the browser sign-in, and the mode refuses to start if anything
     that would weaken that (the dev auth-disable knob, a missing signing secret) is also set.
-  - The staff unit is systemd-hardened (`NoNewPrivileges`, `ProtectSystem=strict` with only the
-    audit-log path writable, `PrivateTmp`); both HTTP faces enforce host allowlists
-    (DNS-rebinding protection), per-identity rate limits, body caps, and auth-before-body-read.
+  - The remote deployment's staff unit (`mcp-server/remote/`) is systemd-hardened (`NoNewPrivileges`,
+    `ProtectSystem=strict` with only the audit-log path writable, `PrivateTmp`). The portal, worker and two
+    assistant-door units an install runs (`driver/systemd/`) set `NoNewPrivileges`, `RestrictSUIDSGID`,
+    `LockPersonality` and `UMask=0007`, and nothing that limits where they write: they can write wherever
+    the install's account can. Both HTTP faces enforce host allowlists (DNS-rebinding protection),
+    per-identity rate limits, body caps, and auth-before-body-read.
 - **Outbound** traffic is enumerated in [What leaves the machine](#what-leaves-the-machine) below.
   No outbound service is given filesystem access: register, research, and case-law calls carry query
   arguments only, and the pool and run dirs are never exposed to them.
@@ -165,17 +168,17 @@ CLI's built-in `WebFetch` (`engine/mcp/gather-config.mjs`), or the driver's stan
 moment of the call, so no list here can be complete, and a deployment that needs one must enforce it at
 the network layer.
 
-**A published report reaches two font CDNs.** The report HTML links stylesheets on `api.fontshare.com`
-and `fonts.googleapis.com`, with the font files on `cdn.fontshare.com` and `fonts.gstatic.com`
-(`publish/render.mjs`, `publish/render-knockout.mjs`; the served CSP admits exactly
-those hosts at `portal-static.mjs`). The reader's browser fetches them when the report
-opens. The request carries no matter data. Registry links in the report resolve only when a reader
+**A report carries its own fonts.** A report published from 0.4.0 on holds Plus Jakarta Sans and Fira
+Code inside itself (`shared/fonts/`), and opening it contacts no other server, from disk, from an email
+or in the portal. CI records every request a rendered report makes and fails on one that leaves
+(`scripts/report-offline-render-check.mjs`). A report published before 0.4.0 still links its two font
+services when opened from disk. The request carries no matter data. Registry links in the report resolve only when a reader
 clicks one.
 
 **The demo contacts nothing.** `bin/example.mjs` re-publishes artifacts already on disk: no `fetch` in its
 module graph, no MCP server, no engine binary. Its two subprocesses are a `git rev-parse` build stamp
-and the browser opener, and the portal binds `127.0.0.1`. The report it opens loads the two font
-stylesheets above.
+and the browser opener, and the portal binds `127.0.0.1`. The report it opens loads nothing from
+another server.
 
 ## Secrets
 
@@ -228,7 +231,9 @@ today — flag for the buyer's compliance review.
   and the engine-local gather MCP servers add none: each is ~130 lines over a shared 120-line stdio
   scaffolding (`driver/engine/mcp/stdio-server.mjs`) with no MCP SDK. The artifacts read layer does
   use the SDK (`@modelcontextprotocol/sdk`, `jose`). Small surface by design.
-- Deploy installs with `--omit=dev --ignore-scripts`. If your deploy then rebuilds a native addon,
+- On an install from a git checkout, `clearotron update` installs with `npm ci --ignore-scripts`, so no
+  package's install script runs on the host. Development packages are kept there, because the portal is
+  rebuilt from them. If your deploy then rebuilds a native addon,
   make that a named, reviewed step: it is the only place a lifecycle script should run on the host.
 - Run a skill scanner over the skills tree at deploy time and abort on high/critical findings. Two
   things to check on any new host: that the scanner is actually installed (a scanner that is absent

package/driver/CHANGELOG.md

@@ -1,5 +1,34 @@
 # clearotron-driver
 
+## 0.4.1-beta.1
+
+### Patch Changes
+
+- Fixed: A report repaired just before delivery keeps its coverage notes, such as a script that was not searched, in the report and the audit workbook.
+- Fixed: A search too broad for the register to count is no longer reported as one that could not be run. The report shows it as too large to read, with the register's own figure.
+- Fixed: On Signa, a crowded search over several spellings now counts each spelling alone, so a rare spelling is no longer reported as crowded.
+- New: `npx clearotron mcp` starts Clearotron's MCP server for an assistant; with no install it answers from the demo's sample runs, and says so.
+- Fixed: The address `clearotron start` and `clearotron demo` print for a client's assistant now answers as soon as it is printed.
+- Fixed: The audit workbook's coverage summary names each area in words, not the engine's identifiers.
+
+## 0.4.1-beta.0
+
+### Patch Changes
+
+- Fixed: A connection library is updated to close a reported weakness in how sign-in details could be sent.
+- Fixed: A clearance started from a connected assistant under the Generic default now appears on Clearances when you choose Generic. Before, it showed only under All companies.
+- Fixed: A register count or record that could not be fetched no longer shows the program's error message to a client. This covers the knockout workbook's count notes, the knockout report and a clearance finding card. Each shows the line the report already uses for something left open.
+- Fixed: A knockout's completion message and email now give its rating, or the highest rating when several names were screened. They no longer use the term 'worst band'.
+- Fixed: A client whose mark is written in another script, such as Greek, Cyrillic or Chinese, now receives the link to the report. Before, the email arrived without one.
+- Fixed: In rare cases, a report repaired just before delivery listed one conflict as two findings. Its last finding also lost its full write-up. The conflict now stays one finding, and every finding keeps its write-up.
+- Fixed: Reports no longer say a search "did not finish and must be re-run" when a name's non-Latin form was in fact searched. They no longer make a conclusion depend on reviewing records the search had already read in full. Knockout reports now list every territory you ordered.
+- Fixed: The audit workbook no longer warns that the depth rules were applied to nothing on a clearance whose narrative is written in sections. Those rules govern per-finding write-ups, and such a narrative has none.
+- Fixed: An order for the European Union now also searches each member state's own trade mark register, at no extra search cost. A national registration — in France, for example — is now found by an EU search.
+- Before you upgrade: if you installed Codex yourself, update it to 0.159.0 or newer first. Older copies cannot use GPT-6.1 Sol, and searches on the OpenAI engine would stop at their first step.
+- New: Searches now use the latest models: Claude Haiku 5.5, Sonnet 5.5 and Opus 5.5, and OpenAI's GPT-6.1 Sol and GPT-6 Luna. Installing or updating Clearotron brings the Claude and Codex programs up to versions that can use them.
+- Fixed: Two different names written in Greek, Cyrillic or Chinese characters, or differing only in an accented letter, can now be screened in one knockout. Before, they were refused as duplicates.
+- Fixed: Findings rated medium risk or higher are now checked for the owner's actual use in the same way on every company's risk ladder. That same search looks for the owner's record of oppositions and disputes, so "Likely to enforce" carries a rating instead of "not checked".
+
 ## 0.4.0
 
 ### Minor Changes

package/driver/binding-layers.mjs

@@ -100,19 +100,39 @@ export function bindingLayersFor(territory) {
     layers.push({ layer: "national", office: BX_OFFICE,
       why: `${t} has no separate national register — Benelux (BX) is the national register for it` });
   } else if (t === WO_OFFICE) {
-    // The international register ORDERED AS a territory. Same shape as the EU below: there is no
-    // national layer to miss, because the Madrid register IS the order. Without this a matter listing
+    // The international register ORDERED AS a territory. There is no national layer to miss, because
+    // the Madrid register IS the order. Without this a matter listing
     // "International" (territory-codes.mjs normalizes it to WO) discloses a missing national register
     // that does not exist — a limitation on a register the plan searched, which is the kind a reader
     // learns to skim.
     layers.push({ layer: "international", office: WO_OFFICE, why: "the international register, ordered directly" });
     return Object.freeze(layers.map(Object.freeze));
-  } else if (t === EU_OFFICE || t === "EU") {
-    // The EU ordered AS a territory. There is no national layer to miss; the EU register IS the order.
-    layers.push({ layer: "regional", office: EU_OFFICE, why: "the EU-wide register, ordered directly" });
+  } else if (t === EU_OFFICE) {
+    // The EU-wide register named by its OFFICE code, which is how a plan that is already resolved
+    // carries it. It names that register, not the territory: resolving a France plan's ["FR", "EM",
+    // "WO"] again must not turn it into a search of every member state. An EU ORDER arrives as "EU"
+    // (normalizeTerritory folds "European Union", EUTM and EUIPO there) and takes the branch below.
+    layers.push({ layer: "regional", office: EU_OFFICE, why: "the EU-wide register, named by its office code" });
     layers.push({ layer: "international", office: WO_OFFICE,
       why: "international registrations designating the EU bind it without a separate EU filing" });
     return Object.freeze(layers.map(Object.freeze));
+  } else if (t === "EU") {
+    // The EU ordered AS a territory: the EU-wide register, EVERY member state's national register, and
+    // international registrations designating the EU or a member. A national right blocks use in its own
+    // member state without appearing in the EU-wide register, so an EU order that searched only EUIPO and
+    // Madrid cleared none of the countries inside it — measured 2026-10-09 on both live providers: an
+    // EU-scoped search returns no member state's national filings, and listing the members in the same
+    // request reaches them. The owner's ruling of the same day: an EU order searches the national
+    // registers too, on every provider. Benelux is one national register for three members, listed once.
+    layers.push({ layer: "regional", office: EU_OFFICE, why: "the EU-wide register, ordered directly" });
+    for (const office of new Set(EU_MEMBERS.map((m) => (BENELUX_MEMBERS.includes(m) ? BX_OFFICE : m)))) {
+      layers.push({ layer: "national", office, why: office === BX_OFFICE
+        ? "Benelux (BX) is the national register of three EU members"
+        : `a national right in ${office} blocks use there without appearing in the EU-wide register` });
+    }
+    layers.push({ layer: "international", office: WO_OFFICE,
+      why: "an international registration designating the EU or a member state binds it without a separate filing" });
+    return Object.freeze(layers.map(Object.freeze));
   } else {
     layers.push({ layer: "national", office: t, why: `the national register of ${t}` });
   }
@@ -215,7 +235,9 @@ export function unsearchedLayerReason(report) {
     regional: "EU-wide rights",
     international: "international registrations designating it",
   };
-  const missing = report.unsearched.map((u) => names[u.layer] ?? u.layer);
+  // One name per KIND of register: an EU order carries a national layer per member state, and a provider
+  // that reaches only some of them would otherwise list "the national register" once per member missed.
+  const missing = [...new Set(report.unsearched.map((u) => names[u.layer] ?? u.layer))];
   const list = missing.length === 1 ? missing[0]
     : `${missing.slice(0, -1).join(", ")} and ${missing[missing.length - 1]}`;
   return `Not a complete clearance for ${report.territory}: ${list} ${missing.length === 1 ? "was" : "were"} `

package/driver/citation-census.json

@@ -1,5 +1,5 @@
 {
-  "citations": 465,
-  "files": 3308,
-  "checkable": 129
+  "citations": 257,
+  "files": 3469,
+  "checkable": 245
 }