merge: promote dev → main — invisible-denial UI fix, ADR-0009 cache policy, sink/settings bookkeeping

CLAUDE.md

@@ -203,6 +203,9 @@ tests/
   rides in every answer's `citation.curation` block, and staleness is **visible, never a refusal**.
 - **ADR-0008** — the structural-variant (fusion) modality: `eventInfo`-based classification, the
   per-study **annotation-depth** gate, and the **modality-scoped** per-gene coverage gate.
+- **ADR-0009** — whoami resolution-cache policy: positive TTL 15 min / negative 60 s /
+  stale-if-error 24 h on HF outage (whoami is attribution, not authorization — the allow-list
+  stays local and fail-closed).
 - Originating decision: `pdac-subtype-agent` **ADR-0019** (scope, data model, sources, panel) +
   `SPIKE-dna-panel-feasibility.md` (cBioPortal proven).
 

TODO.md

@@ -107,12 +107,13 @@ the design doc's M0–M4 is the intent behind it — see that doc's §0).
             attribution is the requirement, so the coupling is paid for, not incidental — this is
             NOT the same trade as ADR-0005 C4, where the coupling bought nothing the artifact
             didn't already give us.
-      - [ ] **Narrowed successor: the resolution cache's TTL and its HF-outage behaviour.**
-            Resolution is already cached per token, so the question is no longer whether to call
-            `whoami` but how long a resolution stays good and what happens when HF is unreachable
-            mid-session — fail closed (deny, losing availability) or serve on a warm cache (keep
-            availability, risk a revoked token working for the TTL). Pick deliberately and write
-            the reason down; today it is whatever the cache happens to do.
+      - [x] **Narrowed successor: the resolution cache's TTL and its HF-outage behaviour.**
+            ✅ (2026-08-12) → **ADR-0009**. Decided: positive TTL 15 min, negative TTL 60 s, and
+            **stale-if-error** — on a *transient* HF failure a positive entry ≤24 h old is served
+            stale (availability wins because `whoami` is attribution, not authorization: the
+            `ALLOWED_IDS` check is local and re-checked every call). A definitive rejection is
+            never rescued by staleness and a cold token stays denied during an outage. 8 tests in
+            `tests/test_whoami_cache_policy.py` (clock + `huggingface_hub.HfApi` mocked).
 - [x] **Confirm cBioPortal ToS for automated use; public instance vs self-host** ✅ (2026-07-24) →
       `docs/cbioportal-terms-and-deployability.md` + **ADR-0005**. Verdict: usable with conditions,
       no ToS bar on automated access, **public instance + curate-and-cache, no self-host**.
@@ -152,10 +153,32 @@ the design doc's M0–M4 is the intent behind it — see that doc's §0).
       Note the dev Space is one docs commit ahead of the deployed prod sha — dev is the staging lane,
       so being ahead is the right direction.
 
-## Open — the dev lane cannot be click-through verified while private
-
-- [ ] **Decide: make `pdac-genomics-agent-dev` public, or accept that UI verification happens on prod
-      only.** Found 2026-08-05 trying to verify the display fixes on dev. The Space **builds and runs
+## Done — denials are now visible in the UI (the "dead button", 2026-08-14)
+
+- [x] **FIXED on dev 2026-08-14 — ADR-0004 denials render in the caution box, not only the
+      collapsed JSON accordion.** All three tabs' denied paths now show
+      "⛔ Access denied. <reason>" via `_denial_caution_md` (`gradio_ui.py`); previously a
+      signed-out/session-expired click updated only the closed "Raw result (JSON)" accordion and
+      hid the caution — visually a dead button (diagnosed same day, see `memory.md`). Gate order
+      and fail-closed behaviour unchanged; `tests/test_ui_handler_gating.py` now asserts denial
+      visibility so it can't regress silently. Merged to dev only; prod promotion is Annie's call.
+
+## Done — the dev lane is now click-through verifiable (public + enforced gate, 2026-08-13)
+
+- [x] **RESOLVED 2026-08-13 — dev Space flipped PUBLIC with the gate enforced (Anne), all
+      post-flip checks pass.** Sequence held: secrets/variables first, gate verified via the
+      machine path while still private (see the secrets item below), THEN the flip. Verified
+      after the flip: `space_info` reports `private: False`;
+      `anne-voigt-pdac-genomics-agent-dev.hf.space` serves the app anonymously (HTTP 200, full UI,
+      no more 404/iframe/`__sign=` maze); a signed-out **click** on "Query variant status" returns
+      `{"status": "denied", "reason": "🔒 Please sign in…"}` in the Raw-result panel — the ADR-0004
+      UI gate, fail-closed on staging exactly as on prod; and the allow-listed path answers with
+      real grounded numbers (KRAS 136/150 = 90.7% on `paad_tcga`, verified same day). The staging
+      log sink writes to `pdac-genomics-results-dev` only. **The dev lane now verifies that the
+      Space ANSWERS, not merely that it boots** — the original item follows, kept for the history.
+
+- [x] ~~Decide: make `pdac-genomics-agent-dev` public, or accept that UI verification happens on prod
+      only.~~ Found 2026-08-05 trying to verify the display fixes on dev. The Space **builds and runs
       fine** — it is *reaching* the UI that fails. Private ⇒ `anne-voigt-pdac-genomics-agent-dev.hf.space`
       is a **404** (the session cookie is on `huggingface.co`, not the `hf.space` origin); through the
       embed the app renders but sits in a cross-origin iframe that synthetic clicks do not reach; and
@@ -166,6 +189,33 @@ the design doc's M0–M4 is the intent behind it — see that doc's §0).
       gradio 6.18.0 — sound for client-side rendering bugs, and NOT sound for anything server-shaped
       (auth, secrets, artifact loading in the Space image).
 
+      **RECOMMENDATION (2026-08-13, awaiting Anne's call): make dev PUBLIC with the gate enforced —
+      the exact model prod has run since 2026-07-28.** Analysis behind it:
+      - *Data exposure — dev adds none.* The restricted-license artifacts (`ccle_broad_2019` Broad
+        terms, `pdac_msk_2024` CC BY-NC-ND) are committed in this repo and have been served — files
+        tab included — by the PUBLIC prod Space since 2026-07-28. Broad's continuity clause is
+        discharged by `CCLE_BROAD_TERMS.md` next to the artifact; the ND question was resolved
+        2026-08-05 (`licenses.py`). The "keep it private because of the artifacts" reasoning in the
+        GitHub-mirror item below predates both facts and no longer applies to *Space* visibility
+        (the mirror's own visibility is a separate decision — leave it private).
+      - *Secrets are not exposed by visibility* — HF secrets stay secret on a public Space.
+      - *Residual delta vs staying private:* a public dev Space shows unreleased code in its files
+        tab (dev is deliberately ahead of prod), and anonymous visitors see the UI shell (tools
+        deny). Both are the accepted prod model; the alternative — first exercising auth/gate
+        changes in production — is exactly what CLAUDE.md warns against.
+      - *Hard sequencing:* the gate is currently DARK on dev (secrets/variables item below).
+        Public-before-gate = an ungated staging app. Order is fixed: configure → verify gate via
+        `gradio_client` + HF token (works while private) → flip public → verify.
+      **Runbook for Anne** (both steps need the Space settings UI, agent cannot do them):
+      1. `pdac-genomics-agent-dev` → Settings → Variables: `ACCESS_CONTROL=enforce`,
+         `ADMIN_IDS=anne-voigt`, `ALLOWED_IDS` (copy prod), `CBIOPORTAL_CONTACT` (copy prod),
+         `LOG_SINK_HF_DATASET` → a **separate dev dataset** (NOT `anne-voigt/pdac-genomics-results`).
+         Secrets: `LOG_SINK_HF_TOKEN`. (This closes the "dev Space secrets/variables" item below.)
+      2. After the Space restarts: Settings → Change visibility → public.
+      3. Then an agent verifies: `anne-voigt-pdac-genomics-agent-dev.hf.space` loads (no 404),
+         signed-out use is denied with the 🔒 message, signed-in allow-listed use answers, and the
+         staging log sink writes to the dev dataset, not prod's.
+
 ## Open — found in the 2026-08-05 signed-in click-through
 
 First click-through since 2026-07-27, against deployed `40ab3dd`. **Every payload was correct**;
@@ -543,12 +593,58 @@ the reasoning → `memory.md` (2026-08-05).
   gradio, `cpu-basic` (prod is free-tier `cpu-basic`, so the twin is free). Built and `RUNNING` at
   `9b5fe82`; `dev` tracks `hf-dev/main`. Closed the last no-staging-step repo in the fleet.
 
-- [ ] **Set the dev Space secrets/variables — the Space is live but UNCONFIGURED.** Without them
-  the ADR-0004 gate is dark there and the log sink is a no-op, so the dev Space is **not yet a
-  valid place to accept a gate change**. In Space settings: `ACCESS_CONTROL`, `ADMIN_IDS`,
-  `ALLOWED_IDS` (as *variables*, matching prod), `LOG_SINK_HF_TOKEN`, `CBIOPORTAL_CONTACT`, and
-  `LOG_SINK_HF_DATASET` → a **separate** dataset, so staging runs do not write into
-  `anne-voigt/pdac-genomics-results`. Needs Annie (Space settings UI).
+- [x] **Set the dev Space secrets/variables** ✅ DONE 2026-08-13 (Anne, Space settings UI).
+  Verified via API 2026-08-14: variables `ACCESS_CONTROL=enforce`, `LOG_SINK=hf`,
+  `LOG_SINK_HF_DATASET=anne-voigt/pdac-genomics-results-dev` (separate dataset, exists, private);
+  secrets `ADMIN_IDS`, `ALLOWED_IDS`, `LOG_SINK_HF_TOKEN`, `HF_TOKEN`. **Decision (Anne,
+  2026-08-14): `ADMIN_IDS`/`ALLOWED_IDS` are SECRETS** on both Spaces — the earlier "as variables,
+  matching prod" wording here was wrong (only `ACCESS_CONTROL` is a variable) and is hereby
+  corrected, not the Spaces. `CBIOPORTAL_CONTACT` remains unset on dev — only needed at curation
+  time, which doesn't run on the Space.
+
+- [~] **Make the PROD audit sink durable — everything set EXCEPT the prod token secret.**
+  Prod had no `LOG_SINK*` settings at all, so audit records went to ephemeral `./run_logs`.
+  Done via API: created the private dataset `anne-voigt/pdac-genomics-results` and set the
+  variables `LOG_SINK=hf` + `LOG_SINK_HF_DATASET=anne-voigt/pdac-genomics-results` on prod.
+  - [ ] **Anne: set the secret `LOG_SINK_HF_TOKEN`** (the `research_agent_token` value) in prod
+    Space settings — until then the HF sink **no-ops and records are dropped** (worse than
+    `local` for retention; safe otherwise — no errors).
+  - [ ] Verify: one signed-in query, then confirm a record file lands in the dataset.
+- [x] **Set the dev Space secrets/variables** — DONE & VERIFIED 2026-08-13. Anne set
+  `ACCESS_CONTROL=enforce`, `LOG_SINK=hf` (the item above had omitted this one — without it the
+  dataset/token vars are inert), `LOG_SINK_HF_DATASET=anne-voigt/pdac-genomics-results-dev`
+  (variables) and `ADMIN_IDS` / `ALLOWED_IDS` / `LOG_SINK_HF_TOKEN` (secrets). Note the original
+  item's "as variables, matching prod" was wrong about prod: the allow-lists are **secrets** on
+  prod, and dev now matches that reality. `CBIOPORTAL_CONTACT` deliberately skipped — curation
+  never runs on the Space and unset is a complete configuration per `cbioportal_io.user_agent`.
+  Created the private dataset `anne-voigt/pdac-genomics-results-dev`. Verified live: machine API
+  → `no_token_header` denial with no credential, `token_unresolved` fail-closed denial on a bogus
+  token, resolves+answers on a valid one; audit records (`enforced: true`) land in the DEV
+  dataset only. The dev Space is now a valid place to accept a gate change → unblocks the
+  "make dev public?" decision. (A successful `panel:api` call writes no record by design — it is
+  a static resource; only denials are recorded on that endpoint.)
+- [x] **DONE 2026-08-13 — dev Space secrets/variables set (Anne) and the gate VERIFIED both ways.**
+  Variables: `ACCESS_CONTROL=enforce`, `LOG_SINK=hf`, `LOG_SINK_HF_DATASET=anne-voigt/pdac-genomics-results-dev`
+  (separate from prod's, as required). `ADMIN_IDS`/`ALLOWED_IDS` are **secrets** (matches prod —
+  another lane confirmed prod holds them as secrets too, so the "as variables" wording formerly in
+  this item described prod wrongly, not the new config). `CBIOPORTAL_CONTACT` left unset — a
+  complete configuration per `cbioportal_io.user_agent()`, and inert on the request path (ADR-0005 C4).
+  Verified via `gradio_client` while still private: allow-listed token + `x-orchestrator-token`
+  header → real answer (KRAS 136/150 = 90.7% on `paad_tcga`, `grounded: true`); garbage token →
+  `machine_auth: token_unresolved`; no header → `no_token_header`. Audit records landed in the
+  **dev** dataset (6 run files), prod's dataset untouched. NOTE for the next tester: gradio 6's
+  `Client(token=…)` does NOT forward the token as `x-hf-authorization` — pass
+  `headers={"x-orchestrator-token": token}` explicitly or every call reads `no_token_header`.
+  **The visibility flip (runbook step 2) is now unblocked** — still Anne's, still pending.
+  ⚠️ 2026-08-14: the intended prod `LOG_SINK_HF_TOKEN` landed on the **dev** Space instead —
+  prod's secrets are still only `ADMIN_IDS`/`ALLOWED_IDS`/`HF_TOKEN` (verified via the
+  `/secrets` API). Confirmed live that prod's sink no-ops: an authorized machine query answered
+  correctly and left NO record and NO `persist_trace failed` log line. Prod was also restarted
+  2026-08-14 to rule out a stale env.
+  - [ ] **Anne: set the secret `LOG_SINK_HF_TOKEN`** (the `research_agent_token` value) on the
+    **PROD** Space (`anne-voigt/pdac-genomics-agent` → Settings) — until then the HF sink
+    **no-ops and records are dropped** (worse than `local` for retention; safe otherwise).
+  - [ ] Verify: one authorized query, then confirm a `runs/<run_id>.json` lands in the dataset.
 
 - [ ] **Re-run `make install-hooks` after any `scripts/hooks/pre-push` edit.** The Makefile
   **copies** the script into `.git/hooks/`, so an edited hook is inert until reinstalled — this bit

docs/adr/ADR-0009-whoami-cache-policy.md

@@ -0,0 +1,74 @@
+# ADR-0009 — whoami resolution-cache policy: TTLs + stale-if-error on HF outage
+
+**Status:** Accepted · **Date:** 2026-08-12 · **Deciders:** Annie (delegated; policy per the
+M3 TODO item "the resolution cache's TTL and its HF-outage behaviour")
+
+**Amends:** ADR-0004 (the machine half of the gate). **Relates to:** ADR-0005 C4 — this is the
+one outbound call deliberately left on the request path (Anne, 2026-08-05: per-user audit
+attribution requires `whoami`; a shared secret is off the table and this ADR does not reopen it).
+
+## Context
+
+Machine callers are identified by resolving their HF token via `whoami`
+(`gradio_ui._resolve_token_identity`). Resolution was cached in a bare dict, so both questions
+this ADR answers were undecided-by-default:
+
+1. **TTL** — a resolution was trusted *forever* (until process restart). A revoked HF token kept
+   resolving indefinitely; a definitively-rejected token stayed rejected even after rotation.
+2. **HF outage mid-session** — warm tokens kept working forever (infinite cache) while cold
+   tokens were denied. Neither arm was chosen; both were dict behaviour.
+
+The framing tension: ADR-0004 is a **fail-closed** gate, which argues for deny-on-outage; but
+this is a low-traffic research Space whose only machine caller is the orchestrator, and taking
+the orchestrator down whenever huggingface.co blips is real, recurring pain for zero attacker
+model — the token's *authorization* never depended on HF in the first place.
+
+## Decision
+
+The key observation: **`whoami` is attribution, not authorization.** The authorization decision
+is the `ALLOWED_IDS` allow-list (ADR-0004), which is local, fail-closed, and re-checked on every
+call regardless of any cache. What the cache can get wrong is therefore bounded: a *revoked HF
+token* continuing to resolve to a (still-allowlisted) name for the cache window.
+
+Three windows, constants at the top of `gradio_ui.py`:
+
+| window | value | reason |
+|---|---|---|
+| positive TTL | **15 min** | bounds a revoked token's usable life; costs ≤4 whoami calls/hour/token |
+| negative TTL | **60 s** | stops a bad token hammering whoami; a rotated token isn't locked out |
+| stale-if-error grace | **24 h** | on a *transient* failure only, a positive entry ≤24 h old is served stale |
+
+Outage semantics, precisely:
+
+- Expiry always triggers a re-verification **attempt** — stale is only served after whoami
+  actually failed transiently.
+- A **definitive** rejection (`HfHubHTTPError`) is never rescued by staleness, and it evicts any
+  prior positive entry (the fresh write overwrites).
+- A **cold** token during an outage stays denied — stale-if-error extends trust already
+  established, it never creates trust.
+- A transient failure is never cached, so an outage denial cannot outlive the outage.
+
+## Consequences
+
+**Positive** — an HF outage no longer takes the orchestrator down (the observed availability
+risk); a revoked token's window drops from "until restart" to ≤15 min normally, ≤24 h through an
+outage; token rotation converges within 60 s.
+
+**Negative** — a token revoked *during* an HF outage keeps attributing calls for up to 24 h.
+Accepted: the caller was allowlisted, the calls are audited under the same identity, and
+revoking *access* (allow-list edit) is instant and cache-independent.
+
+**Neutral** — cache is per-process and unpersisted; a Space restart is a cold start (deny until
+HF is reachable once). Tests: `tests/test_whoami_cache_policy.py`.
+
+## Alternatives considered
+
+1. **Fail closed on outage (no stale serving).** Purest reading of ADR-0004; rejected because it
+   converts every HF blip into a full orchestrator outage while defending against nothing — the
+   allow-list, not whoami, is the gate.
+2. **Infinite stale grace.** Rejected — "revoked token works until restart" is exactly the
+   undecided behaviour this ADR exists to replace; 24 h outlives any plausible HF incident.
+3. **Longer positive TTL (hours).** Rejected — the short TTL is nearly free at this traffic and
+   keeps the normal-operation revocation window small.
+4. **Replace whoami with a shared secret (no outbound call at all).** Out of scope by standing
+   decision (Anne, 2026-08-05): per-user audit attribution requires identity resolution.

docs/adr/RESERVED.md

@@ -48,7 +48,7 @@ use) · `DROPPED` (burned).
 > reads as a pointer to this repo's structural-variant ADR, which is the wrong decision entirely.
 > **The lesson: a bare `ADR-####` in prose is ambiguous the moment two repos share a number —
 > always name the repo when citing a sibling's.**
-| 0009 | CLAIMED | whoami resolution-cache policy — TTL + stale-if-error on HF outage | *(in flight)* |
+| 0009 | PUBLISHED | whoami resolution-cache policy — TTL + stale-if-error on HF outage | `ADR-0009-whoami-cache-policy.md` |
 | **0014** | **EXTERNAL** | Shared security-scan standard (pip-audit + bandit + gitleaks + trivy) — authored in `DecoupleRpy_Agent`. **Do not use;** adopt it, don't renumber it. Adopted here as `security/scan.sh`. | *(sibling repo)* |
 | **0015** | **EXTERNAL** | `data_level` / registry `modality` semantics — authored in `biodata-registry`. **Do not use.** A DNA `modality` extension would be an amendment *there*, under that owner. | *(sibling repo)* |
 

gradio_ui.py

@@ -29,6 +29,7 @@ from __future__ import annotations
 import json
 import os
 import sys
+import time
 from pathlib import Path
 
 import gradio as gr
@@ -75,6 +76,17 @@ def _denied_json(message: str):
     return None, json.dumps({"status": "denied", "reason": message}, indent=2)
 
 
+def _denial_caution_md(message: str):
+    """The denial reason as a VISIBLE caution, not just JSON in the collapsed accordion.
+
+    Before this, a denied click updated only the closed "Raw result (JSON)" accordion and hid
+    the caution box — on screen, nothing happened, indistinguishable from a dead button
+    (diagnosed 2026-08-14). The gate stays exactly where ADR-0004 put it; only where the
+    refusal is *shown* changes.
+    """
+    return gr.update(value=f"⛔ **Access denied.** {message}", visible=True)
+
+
 # The clearing frame (see `_ui_variant_status`): blank each modality chart's VALUE, and do not
 # touch its visibility. Hiding here instead produced a hide→show flip on every query, and the
 # third chart lost that race about half the time — it stayed unmounted while the browser threw
@@ -350,7 +362,34 @@ def _subtype_caution_md(result):
 # Consequence worth remembering: a call that authenticates locally may be denied in the Space.
 # That asymmetry is safe (fail-closed both ways) but will look like a bug if you forget it.
 _MACHINE_TOKEN_HEADERS = ("x-orchestrator-token", "x-hf-authorization")
-_WHOAMI_CACHE: dict[str, str | None] = {}
+
+# Resolution-cache policy (ADR-0009). Each entry is (identity, monotonic-timestamp); the three
+# windows below are the deliberate answers to "how long is a whoami result trusted?" and "what
+# happens when huggingface.co is unreachable mid-session?" — previously both were whatever a bare
+# dict happened to do (trust forever; outage serves warm tokens forever, denies cold ones).
+#
+#   _WHOAMI_TTL_S        — a POSITIVE resolution is fresh for 15 min. This bounds only how long a
+#                          *revoked HF token* keeps resolving to a name; the actual authorization
+#                          decision (ALLOWED_IDS) is local and re-checked on every call, so
+#                          de-authorizing a caller is instant regardless of this window. Cost of
+#                          the short TTL is ≤4 whoami calls/hour per token — nothing, at this
+#                          Space's traffic.
+#   _WHOAMI_NEG_TTL_S    — a DEFINITIVE rejection (HfHubHTTPError) is remembered for 60 s: enough
+#                          to stop a misconfigured caller hammering whoami in a burst, short
+#                          enough that a freshly-rotated token is not locked out.
+#   _WHOAMI_STALE_OK_S   — on a TRANSIENT failure (HF outage / network error), a previously
+#                          POSITIVE entry up to 24 h old is served stale. Availability wins here:
+#                          identity resolution exists for audit attribution, not authorization,
+#                          and the fail-closed gate (ADR-0004) is the allow-list check that never
+#                          leaves this process. Worst case is a token revoked *during* an HF
+#                          outage still attributing calls for ≤24 h — acceptable on a low-traffic
+#                          research Space; the alternative is the orchestrator going down whenever
+#                          HF blips. Stale entries are never served when HF is reachable, and a
+#                          cold or definitively-rejected token stays denied during an outage.
+_WHOAMI_TTL_S = 15 * 60
+_WHOAMI_NEG_TTL_S = 60
+_WHOAMI_STALE_OK_S = 24 * 60 * 60
+_WHOAMI_CACHE: dict[str, tuple[str | None, float]] = {}
 
 # Machine-caller denial text, per diagnosis. Deliberately NOT the UI's "please sign in": a
 # machine caller cannot sign in, and telling it to is what made this look like a Space-side
@@ -380,13 +419,22 @@ def _header_value(headers, name: str) -> str | None:
 
 
 def _resolve_token_identity(token: str) -> str | None:
-    """Resolve an HF token to a username via `whoami` (cached). None = unusable token.
-
-    Only definitive rejections are cached as None; a transient failure denies *this* call but
-    is not remembered, so an upstream blip cannot lock the orchestrator out until restart.
+    """Resolve an HF token to a username via `whoami` (TTL-cached). None = unusable token.
+
+    Cache policy is ADR-0009 (see the `_WHOAMI_*` constants above): positive resolutions are
+    fresh for `_WHOAMI_TTL_S`, definitive rejections for `_WHOAMI_NEG_TTL_S`, and on a
+    *transient* failure only (HF unreachable) a positive entry up to `_WHOAMI_STALE_OK_S` old is
+    served stale — so an upstream outage cannot take the orchestrator down, while the allow-list
+    gate itself stays local and fail-closed. A transient failure with no stale positive entry
+    denies this call and is not remembered.
     """
-    if token in _WHOAMI_CACHE:
-        return _WHOAMI_CACHE[token]
+    now = time.monotonic()
+    entry = _WHOAMI_CACHE.get(token)
+    if entry is not None:
+        identity, stamp = entry
+        ttl = _WHOAMI_TTL_S if identity is not None else _WHOAMI_NEG_TTL_S
+        if now - stamp < ttl:
+            return identity
     try:
         from huggingface_hub import HfApi
         from huggingface_hub.utils import HfHubHTTPError
@@ -394,11 +442,15 @@ def _resolve_token_identity(token: str) -> str | None:
         try:
             identity = HfApi().whoami(token=token).get("name")
         except HfHubHTTPError:
-            _WHOAMI_CACHE[token] = None  # definitive: the token is bad
+            _WHOAMI_CACHE[token] = (None, now)  # definitive: the token is bad
             return None
-    except Exception:  # noqa: BLE001 — transient/import failure: deny, do not cache
+    except Exception:  # noqa: BLE001 — transient/import failure: stale-if-error, else deny
+        if entry is not None:
+            identity, stamp = entry
+            if identity is not None and now - stamp < _WHOAMI_STALE_OK_S:
+                return identity
         return None
-    _WHOAMI_CACHE[token] = identity
+    _WHOAMI_CACHE[token] = (identity, now)
     return identity
 
 
@@ -598,7 +650,7 @@ def _ui_variant_status(source, genes, profile: gr.OAuthProfile | None = None):
     if not allowed:
         record_run("variant_status", username=username, source=src, status="denied")
         _, js = _denied_json(denial)
-        yield (gr.update(value="", visible=False), *_CLEAR_PLOTS, js)
+        yield (_denial_caution_md(denial), *_CLEAR_PLOTS, js)
         return
     yield (gr.update(), *_CLEAR_PLOTS, gr.update())
     result = _safe_result(lambda: _query_variant_status(list(genes) or list(PANEL), source))
@@ -615,7 +667,7 @@ def _ui_variant_by_subtype(
     if not allowed:
         record_run("variant_by_subtype", username=username, source=src, status="denied")
         plot, js = _denied_json(denial)
-        return gr.update(value="", visible=False), plot, js
+        return _denial_caution_md(denial), plot, js
     result = _safe_result(
         lambda: _variant_by_subtype(
             list(genes) or list(PANEL),
@@ -653,7 +705,7 @@ def _ui_byod(
     if not allowed:
         record_run("variant_status:byod", username=username, source=src, status="denied")
         plot, js = _denied_json(denial)
-        return gr.update(value="", visible=False), plot, js
+        return _denial_caution_md(denial), plot, js
 
     def _run():
         if not maf_file and not cnv_file:

memory.md

@@ -4,6 +4,98 @@ Current status + history. Architecture → `CLAUDE.md`. Backlog → `TODO.md`.
 
 ---
 
+## 2026-08-13 — dev Space configured & verified: the gate is live on staging (no code change)
+
+The dev Space `anne-voigt/pdac-genomics-agent-dev` went from "RUNNING but unconfigured" to a
+valid staging target for gate changes. Anne entered the settings; this lane prepared the exact
+values and verified afterward.
+
+**Settings now on dev** — variables: `ACCESS_CONTROL=enforce`, `LOG_SINK=hf`,
+`LOG_SINK_HF_DATASET=anne-voigt/pdac-genomics-results-dev`; secrets: `ADMIN_IDS`, `ALLOWED_IDS`,
+`LOG_SINK_HF_TOKEN`. Two corrections to the TODO item as written:
+
+1. **It omitted `LOG_SINK=hf`** — the dataset/token vars are inert while the sink defaults to
+   `local` (`logging_sink.get_log_sink`).
+2. **"`ADMIN_IDS`/`ALLOWED_IDS` as variables, matching prod" was wrong about prod** — checked via
+   the HF API: prod holds them as *secrets* (only `ACCESS_CONTROL` is a visible variable). Dev now
+   matches prod's actual posture.
+
+Also found while checking prod: **prod had no `LOG_SINK*` settings at all and its default dataset
+`anne-voigt/pdac-genomics-results` did not exist** — prod audit records were going to ephemeral
+`./run_logs` and dying on every restart. Spun off to a separate lane (which created the prod
+dataset and set the prod variables; its `LOG_SINK_HF_TOKEN` secret was still pending Anne at the
+time of writing — see the status fragment).
+
+**Verification (all live against the dev Space):** machine API with no credential →
+`machine_auth: no_token_header` denial; bogus token → `token_unresolved` fail-closed denial;
+valid token → resolves and returns the 36-gene panel. Audit records with `enforced: true` land in
+`pdac-genomics-results-dev` under `runs/`, and none in prod's dataset. Signed-out UI access is
+moot while the Space is private (HF's own wall precedes ours), and the anonymous-denial records
+prove the gate's fail-closed path regardless. Note learned: a *successful* `panel:api` call
+writes no audit record by design — `panel()` returns after the gate without `record_run`; only
+denials are recorded on that endpoint.
+
+Created the private dataset `anne-voigt/pdac-genomics-results-dev`. This item gated the
+"make the dev Space public?" decision — that is now unblocked.
+## 2026-08-13 (latest) — dev Space PUBLIC; the staging lane is whole
+
+Anne flipped visibility the same day. Post-flip verification, all green:
+
+- `space_info` (anonymous) → `private: False`; `anne-voigt-pdac-genomics-agent-dev.hf.space`
+  returns HTTP 200 with no cookies and renders the full app — the 404 / cross-origin-iframe /
+  `__sign=` password-form maze from 2026-08-05 is gone.
+- Signed-out **click-through** on "Query variant status" → `{"status": "denied", "reason":
+  "🔒 Please sign in…"}`. The ADR-0004 UI gate is enforced and fail-closed on staging, matching
+  prod's public+gated model.
+- Allow-listed access answers with grounded numbers (machine path, same day: KRAS 136/150 =
+  90.7% on `paad_tcga`); audit records land in `pdac-genomics-results-dev` only.
+
+**Consequence: the dev lane can now verify that the Space answers, not merely that it boots.**
+Server-shaped changes (auth, secrets, artifact loading) no longer take their first real
+click-through in production. The 2026-08-05 caveat about local-run verification being the only
+option is retired.
+
+---
+
+## 2026-08-13 (later) — dev Space configured; gate verified pre-flip; only the public flip remains
+
+Anne set the dev Space settings the same day. Verified from here while the Space is still private
+(machine path works through privacy; only browser click-through doesn't):
+
+- Variables read via `HfApi.get_space_variables`: `ACCESS_CONTROL=enforce`, `LOG_SINK=hf`,
+  `LOG_SINK_HF_DATASET=anne-voigt/pdac-genomics-results-dev`. `ADMIN_IDS`/`ALLOWED_IDS` are
+  secrets — and that MATCHES prod (another lane checked prod the same day); the old TODO wording
+  "as variables, matching prod" misdescribed prod. `CBIOPORTAL_CONTACT` deliberately unset.
+- Gate, three ways: allow-listed token in `x-orchestrator-token` → real grounded answer
+  (KRAS 136/150 = 90.7% on `paad_tcga` — the post-denominator-fix number); garbage token →
+  `token_unresolved`; no header → `no_token_header`. Fail-closed confirmed on staging.
+- Sink separation: the test runs wrote 6 `runs/*.json` into `pdac-genomics-results-dev`;
+  prod's `pdac-genomics-results` has none.
+- ⚠️ Tooling trap worth remembering: gradio 6's `Client(token=…)` does **not** send
+  `x-hf-authorization` — without an explicit `headers={"x-orchestrator-token": …}` even a valid
+  admin token reads as `no_token_header`. The 2026-07-28 "gradio_client attaches it automatically"
+  note no longer holds on the pinned client.
+
+Remaining: Anne flips visibility → public (Settings UI), then the browser-level checks
+(`*.hf.space` loads, signed-out UI denied, signed-in allow-listed answers).
+
+---
+
+## 2026-08-13 — dev-Space visibility: recommendation written, flip awaits Anne
+
+The "public vs prod-only click-through" decision (TODO, open since 2026-08-05) now carries a
+worked recommendation + runbook in TODO.md: **make dev public with `ACCESS_CONTROL=enforce`**,
+matching prod's model. The load-bearing findings: the licensing argument for privacy is stale —
+`ccle_broad_2019` and `pdac_msk_2024` have been served by the *public* prod Space since
+2026-07-28, with the Broad continuity clause discharged in-repo and the ND question resolved
+2026-08-05, so a public dev Space adds no new data exposure; secrets are unaffected by
+visibility; the only genuine precondition is sequencing — the gate is DARK on dev, so secrets/
+variables must be configured (and gate-verified via `gradio_client` + token, which works while
+private) BEFORE the flip. Both the secret-setting and the visibility flip need the Space settings
+UI, so this is Annie's action; verification steps are in the runbook. No push made from this lane.
+
+---
+
 ## 2026-08-06 — legibility: the header names SV, and the chart no longer stacks (`408908b`, NOT deployed)
 
 **Header.** Title and the variant-status blurb both said "mutation and copy-number status". SV has
@@ -1964,3 +2056,110 @@ Two things the wiring taught, both worth keeping:
 
 ⚠️ The Space has **no secrets set yet** — gate dark, sink a no-op. Not a valid place to accept a
 gate change until that is done (TODO).
+
+## 2026-08-12 — ADR-0009: the whoami cache's TTL and outage behaviour, decided
+
+Closed the M3 narrowed-successor TODO. `_WHOAMI_CACHE` in `gradio_ui.py` was a bare dict —
+resolutions trusted until restart, and an HF outage served warm tokens forever while denying cold
+ones, all undecided-by-default. Now (ADR-0009): entries are `(identity, monotonic-stamp)` with
+**positive TTL 15 min**, **negative TTL 60 s**, and **stale-if-error grace 24 h** — on a
+*transient* whoami failure only, a previously-positive entry is served stale so an HF blip cannot
+take the orchestrator down. The deciding frame: `whoami` is **attribution, not authorization** —
+`ALLOWED_IDS` is local, fail-closed, and re-checked per call, so the worst the cache can do is let
+a *revoked HF token* keep attributing calls for the window. A definitive `HfHubHTTPError` is never
+rescued by staleness; a cold token stays denied in an outage; transient failures are never cached.
+
+Mechanics worth remembering:
+- Ledger protocol followed: 0009 claimed on `main` alone (`c4f9eb5`), pushed to **`github` only**
+  (origin push deploys prod and this session was told not to). The claim also fixed the stale
+  "Next free number: 0008" line — 0008 was already published; next free is **0010**.
+- `HfHubHTTPError` cannot be constructed bare — `response=` is a required kwarg now; the test
+  builds it around a `Mock`. Sockets are blocked in tests, so the mock seam is
+  `huggingface_hub.HfApi` plus a monkeypatched `time.monotonic`.
+- 8 new tests in `tests/test_whoami_cache_policy.py`; full suite 245 green. NOT staged to the dev
+  Space (it still has no secrets — gate dark there anyway) and NOT pushed to origin.
+
+## 2026-08-13 — stray secrets removed from the prod Space (config only, no code)
+
+Deleted `decoupler_results_dev_token` and `decoupler_results_token` from the prod Space's
+secrets at Annie's request — both were added there by mistake on 2026-08-13 while fixing the
+*DecoupleRpy_Agent* dev Space's log-sink token (that saga lives in that repo's memory.md);
+nothing in this repo ever read them. Deletion restarted prod (~90 s rebuild, back RUNNING).
+Post-restart health check: tokenless `/panel` → `denied / no_token_header` — serving, gate
+fail-closed, diagnosis correct. Remaining secrets: `ADMIN_IDS`, `ALLOWED_IDS`, `HF_TOKEN`.
+---
+
+## 2026-08-13 — prod audit sink wired to a durable HF dataset (settings work, no code)
+
+The prod Space `anne-voigt/pdac-genomics-agent` had **no `LOG_SINK*` settings** (verified via HF
+API 2026-08-13), so `logging_sink.py` fell back to the local sink writing `./run_logs` — ephemeral,
+lost on every restart of a free-tier Space with no persistent storage. The default dataset the HF
+sink points at did not exist either. Done this session:
+
+- **Created the private dataset `anne-voigt/pdac-genomics-results`** (the code's default repo id).
+- **Set on the prod Space via API, as *variables*** (auditable without secret access, matching the
+  ACCESS_CONTROL choice): `LOG_SINK=hf`, `LOG_SINK_HF_DATASET=anne-voigt/pdac-genomics-results`.
+  The variable change restarted the Space; watched it back through `RUNNING_APP_STARTING`.
+- **Safe in the interim**: `HFDatasetLogSink` no-ops without a token (checked the code before
+  flipping `LOG_SINK`), so audit writes cannot error while the secret is missing — but records are
+  DROPPED, not written locally, until the token lands. Strictly worse than `local` for retention
+  until Anne acts, strictly better after.
+
+**Still needs Anne (Space settings UI, secret value):** set `LOG_SINK_HF_TOKEN` (the
+`research_agent_token` value) on prod, then run one signed-in query and confirm a record file
+lands in the dataset. Note the sink also falls back to a `research_agent_token` env var if that
+name already exists as a secret on the Space.
+
+**Discrepancy noticed while in the settings API:** prod's *variables* are only `ACCESS_CONTROL`
++ the two new `LOG_SINK*` ones — `ADMIN_IDS`/`ALLOWED_IDS` are evidently secrets on prod, while
+the dev-Space TODO says to set them "as *variables*, matching prod". The docs disagree with the
+Space; reconcile when configuring the dev Space (either flip prod's to variables or fix the TODO
+wording).
+
+---
+
+## 2026-08-14 — "dead button" diagnosed; prod token secret landed on the WRONG Space; secrets decision
+
+Anne reported the prod UI's "Query variant status" button does nothing. Reproduced and root-caused
+by driving the public Space in a browser and speaking the gradio queue protocol directly:
+
+- **The backend is healthy.** The click DOES fire (`queue/join` → `process_completed`,
+  `success: true` in ~1 ms) — but a signed-out session gets the ADR-0004 denial, and that payload
+  updates ONLY the **collapsed "Raw result (JSON)" accordion** while hiding the caution box. So a
+  signed-out (or session-expired) click is **visually indistinguishable from a dead button** — no
+  toast, no chart, no visible change. The two prod restarts on 2026-08-13/14 dropped OAuth
+  sessions, which is almost certainly why it "stopped working". Fix for the user: sign in again.
+  UX finding worth a lane of its own: a denial should be visible without opening the accordion.
+- **The intended prod `LOG_SINK_HF_TOKEN` was set on the DEV Space instead.** Prod's `/secrets`
+  API shows only `ADMIN_IDS`/`ALLOWED_IDS`/`HF_TOKEN`; dev gained `LOG_SINK_HF_TOKEN` 2026-08-13.
+  Confirmed live: an authorized machine query (`x-orchestrator-token`, allow-listed caller)
+  answered correctly (CCLE, 57 lines, n_profiled 53/44/41) and left NO record in the dataset and
+  NO `[logging_sink] persist_trace failed` line in the run logs — the exact signature of the
+  no-token no-op. Prod restarted 2026-08-14 to rule out stale env; still no-op. **Remaining
+  action is Anne's alone: add `LOG_SINK_HF_TOKEN` on PROD Space settings**, then one authorized
+  query and check `runs/` in the dataset.
+- **Decision (Anne): `ADMIN_IDS`/`ALLOWED_IDS` stay SECRETS.** The dev-Space TODO's "as
+  variables, matching prod" wording was the error; docs corrected, Spaces untouched.
+- **The dev Space is now fully configured** (gate + sink, separate `pdac-genomics-results-dev`
+  dataset, private, exists) — the "not a valid place to accept a gate change" caveat is lifted.
+
+Diagnostic trick worth keeping: with gradio 6 the UI click's fn is reachable without the UI —
+`POST /gradio_api/queue/join` with `{fn_index, trigger_id, session_hash}` + an `EventSource` on
+`queue/data` shows exactly what the server yields per frame; `/gradio_api/call/<api_name>` +
+`x-orchestrator-token` exercises the authorized machine path. Space secrets/variables are
+enumerable (keys only) at `/api/spaces/<id>/secrets` and `/variables` — no more guessing what a
+Space carries.
+
+---
+
+## 2026-08-14 — invisible-denial fix landed on dev (the "dead button" UX lane)
+
+The lane the same-day diagnosis called for: an ADR-0004 denial on any of the three UI tabs now
+renders in the **caution markdown box** ("⛔ Access denied. …", visible), instead of only filling
+the collapsed "Raw result (JSON)" accordion while hiding the caution — which had made a
+signed-out/session-expired click visually indistinguishable from a dead button. New helper
+`_denial_caution_md` in `gradio_ui.py`; the gate itself is untouched (still first, still
+fail-closed). `tests/test_ui_handler_gating.py` now asserts denial visibility
+(`_assert_denial_visible`: caution `visible: True` + reason text) in both denial tests, so the
+regression can't come back silently. 237/237 tests pass. Merged to **dev only**; prod promotion
+is Annie's call.

tests/test_ui_handler_gating.py

@@ -72,6 +72,14 @@ def _final(outputs):
     return outputs
 
 
+def _assert_denial_visible(caution, reason):
+    """A denial must land in the caution box the user can actually see, not only in the
+    collapsed JSON accordion — the invisible-denial bug (2026-08-14) looked like a dead button."""
+    assert isinstance(caution, dict)
+    assert caution.get("visible") is True
+    assert reason in caution["value"]
+
+
 UI_CASES = [
     ("_ui_variant_status", ("cbioportal:paad_tcga", ["KRAS"])),
     ("_ui_variant_by_subtype", ("cbioportal:paad_tcga", ["KRAS"], "mutation", "")),
@@ -92,6 +100,7 @@ def test_ui_handler_denies_anonymous(monkeypatch, handler_name, args):
     body = json.loads(outputs[-1])
     assert body["status"] == "denied"
     assert "sign in" in body["reason"].lower()
+    _assert_denial_visible(outputs[0], body["reason"])
 
 
 @pytest.mark.parametrize("handler_name,args", UI_CASES)
@@ -109,6 +118,7 @@ def test_ui_handler_denies_unlisted_user(monkeypatch, handler_name, args):
     body = json.loads(outputs[-1])
     assert body["status"] == "denied"
     assert "someone-else" in body["reason"]
+    _assert_denial_visible(outputs[0], body["reason"])
 
 
 def test_ui_handler_allows_listed_user(monkeypatch):

tests/test_whoami_cache_policy.py

@@ -0,0 +1,135 @@
+"""ADR-0009 — the whoami resolution-cache policy: TTLs + HF-outage behaviour.
+
+Before this policy the cache was a bare dict: a resolution was trusted forever, and an HF
+outage served warm tokens forever while denying cold ones — both undecided-by-default. These
+tests pin the deliberate answers:
+
+- positive resolutions expire after ``_WHOAMI_TTL_S`` (bounds a revoked token's lifetime);
+- definitive rejections expire after ``_WHOAMI_NEG_TTL_S`` (a rotated token isn't locked out);
+- on a *transient* failure only, a positive entry ≤ ``_WHOAMI_STALE_OK_S`` old is served stale
+  (availability through an HF outage; the allow-list gate itself is local and unaffected);
+- a definitive rejection is never rescued by staleness, and a cold token stays denied.
+
+The suite is hermetic (sockets blocked in conftest), so the whoami layer is mocked at
+``huggingface_hub.HfApi``.
+"""
+
+from __future__ import annotations
+
+import time
+from unittest.mock import Mock
+
+import pytest
+from huggingface_hub.utils import HfHubHTTPError
+
+import gradio_ui
+
+
+def _rejection() -> HfHubHTTPError:
+    # `response` is a required kwarg; a bare Mock stands in for the HTTP 401.
+    return HfHubHTTPError(
+        "401 invalid token", response=Mock(status_code=401, headers={}, text="", json=lambda: {})
+    )
+
+
+class _Clock:
+    """Controllable stand-in for time.monotonic."""
+
+    def __init__(self):
+        self.now = 1000.0
+
+    def __call__(self):
+        return self.now
+
+    def advance(self, seconds):
+        self.now += seconds
+
+
+class _FakeApi:
+    """One shared behaviour per test: 'ok', 'reject', or 'outage'."""
+
+    behaviour = "ok"
+    calls = 0
+
+    def whoami(self, token=None):
+        _FakeApi.calls += 1
+        if _FakeApi.behaviour == "reject":
+            raise _rejection()
+        if _FakeApi.behaviour == "outage":
+            raise ConnectionError("huggingface.co unreachable")
+        return {"name": "orchestrator-bot"}
+
+
+@pytest.fixture()
+def clock(monkeypatch):
+    clk = _Clock()
+    monkeypatch.setattr(time, "monotonic", clk)
+    monkeypatch.setattr("huggingface_hub.HfApi", _FakeApi)
+    _FakeApi.behaviour = "ok"
+    _FakeApi.calls = 0
+    gradio_ui._WHOAMI_CACHE.clear()
+    yield clk
+    gradio_ui._WHOAMI_CACHE.clear()
+
+
+def test_fresh_positive_resolution_is_served_from_cache(clock):
+    assert gradio_ui._resolve_token_identity("tok") == "orchestrator-bot"
+    clock.advance(gradio_ui._WHOAMI_TTL_S - 1)
+    assert gradio_ui._resolve_token_identity("tok") == "orchestrator-bot"
+    assert _FakeApi.calls == 1  # second hit never left the cache
+
+
+def test_positive_resolution_expires_and_is_re_verified(clock):
+    gradio_ui._resolve_token_identity("tok")
+    clock.advance(gradio_ui._WHOAMI_TTL_S + 1)
+    # token was revoked upstream in the meantime
+    _FakeApi.behaviour = "reject"
+    assert gradio_ui._resolve_token_identity("tok") is None
+    assert _FakeApi.calls == 2
+
+
+def test_definitive_rejection_is_cached_briefly_then_retried(clock):
+    _FakeApi.behaviour = "reject"
+    assert gradio_ui._resolve_token_identity("tok") is None
+    assert gradio_ui._resolve_token_identity("tok") is None
+    assert _FakeApi.calls == 1  # within the negative TTL: no second whoami
+    clock.advance(gradio_ui._WHOAMI_NEG_TTL_S + 1)
+    _FakeApi.behaviour = "ok"  # token rotated to a valid one
+    assert gradio_ui._resolve_token_identity("tok") == "orchestrator-bot"
+
+
+def test_outage_serves_a_stale_positive_entry(clock):
+    """HF down mid-session: a previously-resolved token keeps working (stale-if-error)."""
+    gradio_ui._resolve_token_identity("tok")
+    clock.advance(gradio_ui._WHOAMI_TTL_S + 1)  # fresh window over → whoami is attempted
+    _FakeApi.behaviour = "outage"
+    assert gradio_ui._resolve_token_identity("tok") == "orchestrator-bot"
+    assert _FakeApi.calls == 2  # it DID try to re-verify before falling back
+
+
+def test_outage_stale_grace_is_bounded(clock):
+    gradio_ui._resolve_token_identity("tok")
+    clock.advance(gradio_ui._WHOAMI_STALE_OK_S + 1)
+    _FakeApi.behaviour = "outage"
+    assert gradio_ui._resolve_token_identity("tok") is None
+
+
+def test_outage_never_rescues_a_cold_token(clock):
+    _FakeApi.behaviour = "outage"
+    assert gradio_ui._resolve_token_identity("never-seen") is None
+
+
+def test_outage_never_rescues_a_definitively_rejected_token(clock):
+    _FakeApi.behaviour = "reject"
+    gradio_ui._resolve_token_identity("bad")
+    clock.advance(gradio_ui._WHOAMI_NEG_TTL_S + 1)
+    _FakeApi.behaviour = "outage"
+    assert gradio_ui._resolve_token_identity("bad") is None
+
+
+def test_transient_failure_is_not_cached(clock):
+    """An outage denial must not poison the cache once HF recovers."""
+    _FakeApi.behaviour = "outage"
+    assert gradio_ui._resolve_token_identity("tok") is None
+    _FakeApi.behaviour = "ok"
+    assert gradio_ui._resolve_token_identity("tok") == "orchestrator-bot"