clearotron 0.4.1-beta.2 → 0.4.1-beta.4

package/driver/suite-census.json

@@ -766,8 +766,8 @@
           "todos": 0
         },
         "a-large-grid-is-served-in-parts-under-the-tool-cap.test.mjs": {
-          "tests": 4,
-          "asserts": 19,
+          "tests": 5,
+          "asserts": 23,
           "skips": 0,
           "todos": 0
         },
@@ -795,6 +795,18 @@
           "skips": 0,
           "todos": 0
         },
+        "a-long-answer-reaches-a-gpt-model-in-parts.test.mjs": {
+          "tests": 5,
+          "asserts": 39,
+          "skips": 0,
+          "todos": 0
+        },
+        "a-long-case-law-answer-reaches-a-gpt-model-in-parts.test.mjs": {
+          "tests": 2,
+          "asserts": 7,
+          "skips": 0,
+          "todos": 0
+        },
         "a-mark-name-cannot-lie-about-how-it-reads.test.mjs": {
           "tests": 9,
           "asserts": 38,
@@ -969,6 +981,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-pin-change-asks-for-a-bench-replay.test.mjs": {
+          "tests": 16,
+          "asserts": 37,
+          "skips": 0,
+          "todos": 0
+        },
         "a-placement-pass-that-lost-its-answers-does-not-succeed.test.mjs": {
           "tests": 7,
           "asserts": 17,
@@ -1365,6 +1383,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-seat-reads-the-band-page-by-page.test.mjs": {
+          "tests": 4,
+          "asserts": 25,
+          "skips": 0,
+          "todos": 0
+        },
         "a-secret-file-is-compared-not-printed.test.mjs": {
           "tests": 5,
           "asserts": 16,
@@ -2020,8 +2044,8 @@
           "todos": 0
         },
         "band-server.test.mjs": {
-          "tests": 24,
-          "asserts": 126,
+          "tests": 26,
+          "asserts": 136,
           "skips": 0,
           "todos": 0
         },
@@ -3083,13 +3107,13 @@
         },
         "engine.anthropic.test.mjs": {
           "tests": 70,
-          "asserts": 260,
-          "skips": 1,
+          "asserts": 262,
+          "skips": 2,
           "todos": 0
         },
         "engine.codex-config.test.mjs": {
-          "tests": 20,
-          "asserts": 70,
+          "tests": 23,
+          "asserts": 89,
           "skips": 0,
           "todos": 0
         },
@@ -3849,6 +3873,12 @@
           "skips": 0,
           "todos": 0
         },
+        "no-stage-is-offered-the-engines-own-web-search.test.mjs": {
+          "tests": 4,
+          "asserts": 10,
+          "skips": 0,
+          "todos": 0
+        },
         "no-test-account-reaches-the-package.test.mjs": {
           "tests": 17,
           "asserts": 31,
@@ -5799,6 +5829,12 @@
           "skips": 0,
           "todos": 0
         },
+        "the-engine-pins-come-from-the-tree.test.mjs": {
+          "tests": 6,
+          "asserts": 24,
+          "skips": 0,
+          "todos": 0
+        },
         "the-engine-sets-no-sampling-and-forces-no-tool.test.mjs": {
           "tests": 6,
           "asserts": 9,

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-artifacts-mcp
 
+## 0.4.1-beta.4
+
+No changes in this release.
+
+## 0.4.1-beta.3
+
+No changes in this release.
+
 ## 0.4.1-beta.2
 
 No changes in this release.

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.4.1-beta.2",
+  "version": "0.4.1-beta.4",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron",
   "mcpName": "io.github.CordilleraSarl/clearotron",
   "type": "module",
-  "version": "0.4.1-beta.2",
+  "version": "0.4.1-beta.4",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/dist/assets/{index-BPAUjcI0.js → index-DcLbvFmQ.js}

@@ -25046,8 +25046,7 @@ function engineCapabilityRows(providers) {
 		ok: p.configured,
 		name: splitSourceLabel(p.providerLabel ?? p.provider ?? "").name.replace(/'/g, "’"),
 		mono: "provided by the engine",
-		state: p.configured ? "Available" : "Not available",
-		note: "The model searches the web itself during a run."
+		state: p.configured ? "Available" : "Not available"
 	}));
 }
 function providerRow(p) {

package/portal-ui/dist/index.html

@@ -36,7 +36,7 @@
       chosen anywhere in the product holds everywhere in it.
     -->
     <script>(function(){try{var t=localStorage.getItem('cordillera-theme');if(t==='dark'||t==='light')document.documentElement.setAttribute('data-theme',t);}catch(e){}})();</script>
-    <script type="module" crossorigin src="/portal/assets/index-BPAUjcI0.js"></script>
+    <script type="module" crossorigin src="/portal/assets/index-DcLbvFmQ.js"></script>
     <link rel="stylesheet" crossorigin href="/portal/assets/index-D2wrw9cH.css">
   </head>
   <body>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.4.1-beta.2",
+  "version": "0.4.1-beta.4",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {
@@ -24,6 +24,6 @@
     "@types/react-dom": "^19.3.0",
     "@vitejs/plugin-react": "^6.1.2",
     "typescript": "^7.0.2",
-    "vite": "^8.3.3"
+    "vite": "^8.3.4"
   }
 }

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-oauth-mcp-bridge
 
+## 0.4.1-beta.4
+
+No changes in this release.
+
+## 0.4.1-beta.3
+
+No changes in this release.
+
 ## 0.4.1-beta.2
 
 No changes in this release.

package/providers/oauth-mcp-bridge/bridge.mjs

@@ -30,6 +30,7 @@ import { appendFileSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
 import { driverDir } from "../../shared/driver-dir.mjs";   //
+import { answerBudget, answerPieces, servedPart, partNotHeld, takePart, heldAnswers, withAnswerPart } from "../../shared/answer-parts.mjs";
 import { RefreshLock } from "./refresh-lock.mjs";
 import { exitOnStdinClose } from "./stdin-guard.mjs";
 
@@ -327,6 +328,19 @@ async function main() {
     { capabilities: { tools: {} } },
   );
 
+  // A LONG ANSWER IS SERVED IN PARTS when the bridge was given an answer size (shared/answer-parts.mjs). An
+  // answer made of text alone is split; one carrying anything else is passed on as it came.
+  const budget = answerBudget();
+  const held = heldAnswers();
+  const partedResult = (tool, args, res) => {
+    const blocks = Array.isArray(res?.content) ? res.content : [];
+    if (!blocks.length || !blocks.every((c) => c?.type === "text")) return res;
+    const pieces = answerPieces(blocks.map((c) => String(c.text ?? "")).join("\n"), budget, tool);
+    if (pieces.length === 1) return res;
+    held.hold(tool, args, pieces);
+    return { content: [{ type: "text", text: servedPart(tool, pieces, 1) }] };
+  };
+
   downstream.setRequestHandler(ListToolsRequestSchema, async () => {
     const upstreamResp = await upstream.listTools();
     const upstreamTools = upstreamResp?.tools ?? [];
@@ -339,7 +353,7 @@ async function main() {
         `[oauth-bridge:${serverName}] filtered ${dropped.length} unlisted upstream tool(s) from ListTools: ${dropped.join(", ")}\n`,
       );
     }
-    return { ...upstreamResp, tools };
+    return { ...upstreamResp, tools: budget ? tools.map((t) => ({ ...t, inputSchema: withAnswerPart(t.inputSchema) })) : tools };
   });
 
   downstream.setRequestHandler(CallToolRequestSchema, async (req) => {
@@ -353,12 +367,20 @@ async function main() {
         `Tool "${name}" is not in the bridge allowlist for ${serverName}. To enable it, add the unprefixed upstream name to ALLOWED_TOOLS in bridge.mjs and restart.`,
       );
     }
+    // A later part of a held answer is read from it; the upstream server is not asked again.
+    const { args, part } = budget ? takePart(req.params.arguments) : { args: req.params.arguments, part: null };
+    const kept = part ? held.get(name, args) : null;
+    if (part && (kept || part > 1)) {
+      logCall(serverName, name, args, kept ? { ok: true, answer_part: part, of: kept.length } : { ok: false, answer_part: part, held: false });
+      return kept ? { content: [{ type: "text", text: servedPart(name, kept, part) }] }
+        : { isError: true, content: [{ type: "text", text: partNotHeld(name, part) }] };
+    }
     try {
-      const res = await upstream.callTool({ name, arguments: req.params.arguments });
+      const res = await upstream.callTool({ name, arguments: args });
       const refused = toolError(res);
       if (refused === null) logCall(serverName, name, req.params.arguments, { ok: true, bytes: resultBytes(res) });
       else logCall(serverName, name, req.params.arguments, { ok: false, error: refused });
-      return res;
+      return budget && refused === null ? partedResult(name, args, res) : res;
     } catch (err) {
       // A FAILED CALL IS LOGGED TOO, and it is the half that matters: without it, "the search ran and
       // found nothing" and "the search errored" leave the same trace — the ambiguity is about.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.4.1-beta.2",
+  "version": "0.4.1-beta.4",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/scripts/bench-replay-request.mjs

@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// bench-replay-request.mjs — ask for a replay of saved cases when a push moved the engine pins.
+//
+//   node scripts/bench-replay-request.mjs     # in the push workflow; reads SHA, BEFORE, REPO, GH_TOKEN
+//
+// A change to a model or an engine program's floor changes what a clearance reads and writes while every
+// test around it stays green, so it is replayed on saved cases before the beta that carries it is cut.
+// This is the request: a `bench replay` status on the pushed commit, `pending` with the description
+// `waiting`. The machine that holds the saved cases picks it up, replays, and sets pass or flag. Nothing
+// waits for it here and nothing is blocked; the cut reads it (release-bench-replay-check.mjs).
+//
+// WHAT IS COMPARED. The pushed commit against the branch's previous tip (BEFORE), both judged by THIS
+// commit's rule (engine-pins.mjs), so a tree from before that script existed still gets a real answer.
+// A new branch has no previous tip and is compared with where it leaves main. Equal pins post nothing.
+// A parent this rule cannot read posts `waiting` too: "could not tell" is never "unchanged".
+//
+// A SQUASH ON MAIN ASKS ONCE. When the pushed commit is the squash of a pull request whose head already
+// carries a final answer for the same pins, that answer is copied rather than asked for again.
+//
+// The status carries the context and one word, never a link, a count or a case: it sits on a public commit.
+//
+// Exit 0: done (posted, copied, or nothing to ask). Exit 2: could not look.
+
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { join, dirname } from "node:path";
+import { pinState } from "./engine-pins.mjs";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
+
+export const CONTEXT = "bench replay";
+export const PIN_FILES = ["driver/engine/openai-agent.mjs", "driver/driver.config.mjs"];
+const NO_COMMIT = /^0+$/;
+
+const git = (args, cwd) => execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+
+/** The pins of `commit`, judged by the rule in this checkout: its two pin files, laid into a scratch tree. */
+export function pinsAt(commit, { cwd = process.cwd() } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), "engine-pins-"));
+  try {
+    for (const rel of PIN_FILES) {
+      let text;
+      try { text = execFileSync("git", ["show", `${commit}:${rel}`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 64 * 1024 * 1024 }); }
+      catch { continue; }   // absent at that commit: the rule below says could-not-look, by name
+      mkdirSync(dirname(join(dir, rel)), { recursive: true });
+      writeFileSync(join(dir, rel), text);
+    }
+    return pinState(dir);
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+}
+
+/** The latest `bench replay` state on `sha`, or null. `api(path)` answers a GitHub REST GET. */
+export async function latestReplay(api, sha) {
+  const statuses = await api(`commits/${sha}/statuses?per_page=100`);
+  const mine = statuses.filter((s) => s.context === CONTEXT);   // newest first, as the API lists them
+  return mine.length ? { state: mine[0].state, description: mine[0].description ?? "" } : null;
+}
+
+/**
+ * What to post on `sha`, or null for nothing. PURE apart from the injected readers, so each path is tested
+ * without a repository or a network: `pins(commit)` returns a pin state or throws; `squashHead()` names the
+ * merged pull request's head when `sha` is a squash on main, else null; `replay(sha)` is latestReplay.
+ */
+export async function decide({ sha, parent, pins, squashHead, replay }) {
+  const head = pins(sha);
+  let before = null;
+  try { before = pins(parent); } catch { /* could not tell: ask */ }
+  if (before && before.digest === head.digest) return null;
+  const prHead = await squashHead();
+  if (prHead) {
+    let prPins = null;
+    try { prPins = pins(prHead); } catch { /* could not tell: ask */ }
+    const answer = prPins && prPins.digest === head.digest ? await replay(prHead) : null;
+    if (answer && (answer.state === "success" || answer.state === "failure")) return answer;
+  }
+  return { state: "pending", description: "waiting" };
+}
+
+if (isEntrypoint(import.meta.url)) {
+  const { SHA, BEFORE = "", REPO, GH_TOKEN } = process.env;
+  if (!SHA || !REPO || !GH_TOKEN) { process.stderr.write("bench-replay-request: SHA, REPO and GH_TOKEN are required\n"); process.exit(2); }
+  const api = async (path, init = {}) => {
+    const r = await fetch(`https://api.github.com/repos/${REPO}/${path}`, {
+      ...init, headers: { authorization: `Bearer ${GH_TOKEN}`, accept: "application/vnd.github+json", ...(init.headers ?? {}) } });
+    if (!r.ok) throw new Error(`${init.method ?? "GET"} ${path}: ${r.status}`);
+    return r.json();
+  };
+  try {
+    const parent = BEFORE && !NO_COMMIT.test(BEFORE) ? BEFORE : git(["merge-base", "origin/main", SHA]);
+    const decision = await decide({
+      sha: SHA, parent,
+      pins: (c) => pinsAt(c),
+      squashHead: async () => {
+        const pulls = await api(`commits/${SHA}/pulls`);
+        const pr = pulls.find((p) => p.merge_commit_sha === SHA && p.merged_at);
+        if (!pr) return null;
+        git(["fetch", "--quiet", "origin", `refs/pull/${pr.number}/head`]);
+        return pr.head.sha;
+      },
+      replay: (s) => latestReplay(api, s),
+    });
+    if (!decision) { console.log(`bench-replay-request: the engine pins did not move against ${parent.slice(0, 12)}; nothing to ask`); process.exit(0); }
+    await api(`statuses/${SHA}`, { method: "POST", body: JSON.stringify({ state: decision.state, context: CONTEXT, description: decision.description }) });
+    console.log(`bench-replay-request: ${CONTEXT} set to ${decision.state} (${decision.description}) on ${SHA.slice(0, 12)}`);
+  } catch (e) {
+    process.stderr.write(`bench-replay-request: could not look — ${e.message}\n`);
+    process.exit(2);
+  }
+}

package/scripts/e2e-first-time.mjs

@@ -222,7 +222,7 @@ export const NOT_COUNTED_EVENTS = {
     "stale-repair-entry", "taint-disclose", "unsettled-inputs", "verdict-2", "verdict-3",
   ],
   "read from its own record: the stage records, the dispatch records and the tool-call log": [
-    "attempt", "stage", "settled", "started",
+    "answer-part", "attempt", "stage", "settled", "started",
   ],
   "the portal's, the profile store's or the config store's audit log, never a run log": [
     "compose-read", "demo-order", "family-group", "family-ungroup", "other", "person-add", "person-change",

package/scripts/engine-pins.mjs

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// engine-pins.mjs — the engine pins a tree carries: the models the Codex engine asks for, and the program
+// each engine runs, with the oldest version it accepts.
+//
+//   node scripts/engine-pins.mjs                # the tree this script sits in
+//   node scripts/engine-pins.mjs --root <dir>   # another tree, judged by this script's rule
+//
+// WHY IT EXISTS. A change to a model or to an engine program's floor changes what a clearance reads and
+// writes, while every test of the code around it stays green. Such a change asks for a replay of saved
+// cases before the beta that carries it is cut. This is the one definition of "such a change": the push
+// workflow compares a commit with its parent by it, the cut compares the last published version with
+// main by it, and the replay reads it to see which engine moved. A second copy of the rule would drift.
+//
+// WHAT COUNTS. The three Codex model defaults in driver/engine/openai-agent.mjs (JUDGMENT, SWEEP and
+// CHEAP), and the `package` and `floor` of both entries in ENGINE_BINARIES in driver/driver.config.mjs.
+// The Claude engine asks for a tier by name and its program resolves it, so for Claude the program's
+// floor IS the model choice. Values are parsed, not lines: an edited comment or a moved line is not a
+// change. Left out on purpose: the tier each stage asks for, and anything a box's settings override.
+//
+// IT NEVER READS THE ENVIRONMENT. Each model default sits behind a setting that overrides it on a box;
+// this reports the source's default, so two machines with different settings print the same pins for one
+// tree. Judging an older tree with --root applies THIS script's rule to it, which is how a tree from
+// before this script existed still gets an answer.
+//
+// OUTPUT: one line of JSON, keys sorted at every level, no spaces:
+//   {"digest":"sha256:<hex>","pins":{"anthropic-agent":{"floor","package"},"openai-agent":{"floor","models":{"cheap","judgment","sweep"},"package"}},"schema":1}
+// `digest` is the sha256 of `pins` alone in that same form, so equal digests are equal pins; `schema`
+// sits outside it, so a change of format never reads as a change of pins.
+//
+// Exit 0: printed. Exit 2: could not look — a file missing, or a value not found exactly once. The reason
+// goes to stderr and nothing to stdout, because a partial answer compared as a whole reads as a change or,
+// worse, as none.
+
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { join, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
+
+export const SCHEMA = 1;
+const MODELS_FILE = "driver/engine/openai-agent.mjs";
+const BINARIES_FILE = "driver/driver.config.mjs";
+const ENGINES = ["anthropic-agent", "openai-agent"];
+const CODEX_MODELS = { judgment: "JUDGMENT", sweep: "SWEEP", cheap: "CHEAP" };
+
+class CouldNotLook extends Error {}
+
+/** Exactly one match of `re` in `text`, or could-not-look naming `what`. */
+function one(text, re, what) {
+  const found = [...text.matchAll(re)];
+  if (found.length !== 1) throw new CouldNotLook(`${what}: found ${found.length} time(s), expected exactly 1`);
+  return found[0];
+}
+
+/** The source with whole-line comments removed, so a commented-out value is not a value. */
+const code = (text) => text.split("\n").filter((l) => !/^\s*\/\//.test(l)).join("\n");
+
+function read(root, rel) {
+  try { return readFileSync(join(root, rel), "utf8"); }
+  catch (e) { throw new CouldNotLook(`${rel}: ${e.code ?? e.message}`); }
+}
+
+/** The pins of the tree at `root`. Throws CouldNotLook when any value cannot be read exactly once. */
+export function readPins(root) {
+  const models = code(read(root, MODELS_FILE));
+  const codex = {};
+  for (const [key, name] of Object.entries(CODEX_MODELS)) {
+    const re = new RegExp(`^const ${name}\\s*=\\s*process\\.env\\.CLEAROTRON_OPENAI_MODEL_${name}\\s*\\|\\|\\s*"([^"]+)"\\s*;`, "gm");
+    codex[key] = one(models, re, `${MODELS_FILE} ${name}`)[1];
+  }
+  const binaries = code(read(root, BINARIES_FILE));
+  const table = one(binaries, /^export const ENGINE_BINARIES = \{\n([\s\S]*?)^\};/gm, `${BINARIES_FILE} ENGINE_BINARIES`)[1];
+  const pins = {};
+  for (const engine of ENGINES) {
+    const start = one(table, new RegExp(`^ {2}"${engine}":\\s*\\{`, "gm"), `${BINARIES_FILE} ${engine}`).index;
+    const rest = table.slice(start + 1);
+    const next = rest.search(/^ {2}"[a-z-]+":\s*\{/m);
+    const entry = next === -1 ? rest : rest.slice(0, next);
+    pins[engine] = {
+      package: one(entry, /\bpackage:\s*"([^"]+)"/g, `${BINARIES_FILE} ${engine} package`)[1],
+      floor: one(entry, /\bfloor:\s*"([^"]+)"/g, `${BINARIES_FILE} ${engine} floor`)[1],
+    };
+  }
+  pins["openai-agent"].models = codex;
+  return pins;
+}
+
+/** JSON with keys sorted at every level and no whitespace: one value, one string. */
+export function canonical(v) {
+  if (Array.isArray(v)) return `[${v.map(canonical).join(",")}]`;
+  if (v && typeof v === "object") return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(",")}}`;
+  return JSON.stringify(v);
+}
+
+export function pinState(root) {
+  const pins = readPins(root);
+  return { digest: `sha256:${createHash("sha256").update(canonical(pins)).digest("hex")}`, pins, schema: SCHEMA };
+}
+
+if (isEntrypoint(import.meta.url)) {
+  const args = process.argv.slice(2);
+  let root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+  if (args.length === 2 && args[0] === "--root") root = resolve(args[1]);
+  else if (args.length) {
+    process.stderr.write("usage: node scripts/engine-pins.mjs [--root <dir>]\n");
+    process.exit(2);
+  }
+  try {
+    process.stdout.write(`${canonical(pinState(root))}\n`);
+  } catch (e) {
+    if (!(e instanceof CouldNotLook)) throw e;
+    process.stderr.write(`engine-pins: could not look — ${e.message}\n`);
+    process.exit(2);
+  }
+}

package/scripts/release-bench-replay-check.mjs

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// release-bench-replay-check.mjs — a cut waits while a moved engine pin has no passing bench replay.
+//
+//   node scripts/release-bench-replay-check.mjs [--since <tag>] [--head <ref>]    # reads REPO and GH_TOKEN
+//
+// The push workflow asks for a replay of saved cases whenever a push moves the engine pins
+// (bench-replay-request.mjs); the machine holding the cases answers with a `bench replay` status, pass or
+// flag. This is where that answer is read: before a beta or a stable is cut from HEAD, or from `--head`
+// when the checkout is not on the commit being cut (the dispatcher reads origin/main from its own checkout).
+//
+// WHAT IT COMPARES. The pins at HEAD against the pins at the last version cut (`--since`, by default the
+// newest `v*` tag HEAD contains), both judged by THIS checkout's rule. Equal pins: nothing to read. Moved
+// pins: the commits since that tag, on main's own line, whose pins equal HEAD's are the ones that carry
+// today's pins, and one of them must carry a passing `bench replay`.
+//
+// WHAT HOLDS THE CUT, and only one thing lets it through:
+//   pass on any of those commits ............ cut
+//   flag, and no pass ....................... held — fix it, or explain it on the change's issue and set pass by hand
+//   waiting, or no status at all ............ held — "not reported"; an absent answer is never a pass
+// The output names the commit and the state, never a count or a case: it is printed in a public log.
+//
+// Exit 0: nothing moved, or a replay passed. Exit 1: held. Exit 2: could not look.
+
+import { execFileSync } from "node:child_process";
+import { pinsAt, latestReplay, CONTEXT } from "./bench-replay-request.mjs";
+import { isEntrypoint } from "../shared/is-entrypoint.mjs";
+
+const git = (args) => execFileSync("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+
+/**
+ * The verdict for a cut of `head` since `since`. PURE apart from the injected readers: `pins(commit)`
+ * returns a pin state or throws, `line()` lists the commits since `since` on main's own line, newest first,
+ * and `replay(sha)` returns the latest `bench replay` state or null.
+ */
+export async function verdict({ head, since, pins, line, replay }) {
+  const now = pins(head);
+  let then = null;
+  try { then = pins(since); } catch { /* could not tell: the replay must answer */ }
+  if (then && then.digest === now.digest) return { hold: false, why: `no engine pin moved since ${since}` };
+  const carrying = [];
+  for (const c of line()) {
+    let p = null;
+    try { p = pins(c); } catch { /* a commit the rule cannot read carries no answer */ }
+    if (!p || p.digest !== now.digest) break;   // older than the last move: its answer was for other pins
+    carrying.push(c);
+  }
+  const answers = [];
+  for (const c of carrying) answers.push({ sha: c, answer: await replay(c) });
+  const pass = answers.find((a) => a.answer?.state === "success");
+  if (pass) return { hold: false, why: `${CONTEXT}: ${pass.answer.description || "pass"} on ${pass.sha.slice(0, 12)}` };
+  const flag = answers.find((a) => a.answer?.state === "failure");
+  if (flag) return { hold: true, why: `${CONTEXT}: flagged on ${flag.sha.slice(0, 12)} — fix it, or explain it on the change's issue and set pass by hand` };
+  return { hold: true, why: `${CONTEXT}: not reported for the engine pins at ${String(head).slice(0, 12)}${answers.some((a) => a.answer) ? " (still waiting)" : ""}` };
+}
+
+if (isEntrypoint(import.meta.url)) {
+  const { REPO, GH_TOKEN } = process.env;
+  const args = process.argv.slice(2);
+  try {
+    if (!REPO || !GH_TOKEN) throw new Error("REPO and GH_TOKEN are required");
+    const opt = {};
+    for (let i = 0; i < args.length; i += 2) {
+      if (!["--since", "--head"].includes(args[i]) || args[i + 1] === undefined) throw new Error("usage: [--since <tag>] [--head <ref>]");
+      opt[args[i].slice(2)] = args[i + 1];
+    }
+    const head = git(["rev-parse", `${opt.head ?? "HEAD"}^{commit}`]);
+    const since = opt.since ?? git(["describe", "--tags", "--abbrev=0", "--match", "v*", head]);
+    const api = async (path) => {
+      const r = await fetch(`https://api.github.com/repos/${REPO}/${path}`,
+        { headers: { authorization: `Bearer ${GH_TOKEN}`, accept: "application/vnd.github+json" } });
+      if (!r.ok) throw new Error(`GET ${path}: ${r.status}`);
+      return r.json();
+    };
+    const v = await verdict({
+      head, since, pins: (c) => pinsAt(c),
+      line: () => git(["rev-list", "--first-parent", `${since}..${head}`]).split("\n").filter(Boolean),
+      replay: (sha) => latestReplay(api, sha),
+    });
+    console.log(`release-bench-replay-check: ${v.why}`);
+    process.exit(v.hold ? 1 : 0);
+  } catch (e) {
+    process.stderr.write(`release-bench-replay-check: could not look — ${e.message}\n`);
+    process.exit(2);
+  }
+}

package/scripts/settings-render-check.mjs

@@ -380,7 +380,6 @@ const signInProbe = `(() => {
 const out = {}
 const SPEC = {
   signInName: "Through your organisation's sign-in service",
-  webSearch: ['The engine’s own web search', 'provided by the engine', 'Available', 'The model searches the web itself during a run.'],
   categories: ['Trademark register', 'Common-law and marketplace research', 'Open-web search', 'Case law and oppositions'],
   caseLawGap: 'Until these are set up, a Full country search still runs and its report discloses the case-law gap instead of reporting no adverse case law.',
   adminLine: 'To change the address, the permissions or the companies on it, contact your Clearotron administrator.',
@@ -398,7 +397,9 @@ for (const theme of ['light', 'dark']) {
   // ── Installation settings
   console.log('\nInstallation settings:')
   loads.length = 0
-  if (await open('/portal/admin/config', "document.querySelectorAll('.cfg-row').length >= 10", 'Installation settings drew its rows')) {
+  // Nine rows: sign-in, the engine, and seven providers. The engine's own web search had a tenth; it is off on
+  // both engines and has no row.
+  if (await open('/portal/admin/config', "document.querySelectorAll('.cfg-row').length >= 9", 'Installation settings drew its rows')) {
     await setTheme(theme)
     const s = (await evalIn(settingsProbe)) ?? {}
     out[`settings-${theme}`] = s
@@ -411,12 +412,10 @@ for (const theme of ['light', 'dark']) {
       `the sign-in row reads "${SPEC.signInName} · Configured" (saw ${JSON.stringify(si)})`)
     ok(si && same(si.mono, [`auth-proxy · issuer ${ISSUER}`]), `the mode and issuer are the row's quiet mono line (saw ${JSON.stringify(si?.mono)})`)
     const rights = [...s.signIn, ...s.engine, ...s.categories.flatMap((c) => c.rows)].map((r) => r.stateRight)
-    ok(rights.length >= 10 && new Set(rights).size === 1, `every state lines up in one column (right edges ${JSON.stringify([...new Set(rights)])})`)
-    ok(s.engine.length === 2 && s.engine[0].name === 'Anthropic' && s.engine[0].state === 'Subscription',
-      `Engine carries the engine row first (saw ${JSON.stringify(s.engine[0])})`)
-    const web = s.engine[1]
-    ok(web && same([web.name, web.val, web.state, web.notes[0]], SPEC.webSearch),
-      `the engine's own web search sits under Engine, in the page's words (saw ${JSON.stringify(web)})`)
+    ok(rights.length >= 9 && new Set(rights).size === 1, `every state lines up in one column (right edges ${JSON.stringify([...new Set(rights)])})`)
+    ok(s.engine.length === 1 && s.engine[0].name === 'Anthropic' && s.engine[0].state === 'Subscription',
+      `Engine carries the engine row alone (saw ${JSON.stringify(s.engine)})`)
+    ok(!s.engine.some((r) => /web search/i.test(r.name)), "the engine's own web search, off on both engines, has no row under Engine")
     ok(same(s.categories.map((c) => c.label), SPEC.categories), `four provider categories, in order (saw ${JSON.stringify(s.categories.map((c) => c.label))})`)
     const repeated = s.categories.flatMap((c) => c.rows.filter((r) => [r.name, r.val ?? '', ...r.notes].some((t) => t.includes(c.label))).map((r) => `${c.label} on ${r.name}`))
     ok(repeated.length === 0, `no category name is repeated on a row (saw ${JSON.stringify(repeated)})`)