diff --git a/CLAUDE.md b/CLAUDE.md
index 64cf5d8..e8f4fac 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -105,11 +105,11 @@ MCP servers, one per domain:
 
 | Domain | URL | Audience scopes to request |
 |---|---|---|
-| catalog | `https://catalog-dev.sttlab.local/catalog-mcp` | `mcp-catalog-audience kong-token-exchange-broker-audience` |
-| customers | `https://customers-dev.sttlab.local/customers-mcp` | `mcp-customers-audience kong-token-exchange-broker-audience` |
-| payments | `https://payments-dev.sttlab.local/payments-mcp` | `mcp-payments-audience kong-token-exchange-broker-audience` |
-| sales | `https://sales-dev.sttlab.local/sales-mcp` | `mcp-sales-audience kong-token-exchange-broker-audience` |
-| workforce | `https://workforce-dev.sttlab.local/workforce-mcp` | `mcp-workforce-audience kong-token-exchange-broker-audience` |
+| catalog | `https://catalog-dev.sttlab.local/catalog-mcp` | `mcp-catalog-audience token-exchange-broker-audience` |
+| customers | `https://customers-dev.sttlab.local/customers-mcp` | `mcp-customers-audience token-exchange-broker-audience` |
+| payments | `https://payments-dev.sttlab.local/payments-mcp` | `mcp-payments-audience token-exchange-broker-audience` |
+| sales | `https://sales-dev.sttlab.local/sales-mcp` | `mcp-sales-audience token-exchange-broker-audience` |
+| workforce | `https://workforce-dev.sttlab.local/workforce-mcp` | `mcp-workforce-audience token-exchange-broker-audience` |
 
 **Two scopes per server, not one.** The MCP endpoint exchanges the token again
 on its own account before reaching the domain API, so the token must also name
@@ -120,9 +120,9 @@ Measured on catalog: with both scopes the MCP server answers `200`, with
 `mcp-catalog-audience` alone it answers `401`. LibreChat has always requested
 both.
 
-This is a property of the contract as it stands, not of any agent's design. The
-broker client is still named after the middleware that introduced it, which is
-a leak worth closing — see the blockers.
+This is a property of the contract as it stands, not of any agent's design. If
+the middleware serving these URLs is replaced by something that does not
+re-exchange, the second scope simply becomes unnecessary.
 
 LLM inference goes through the estate's LLM endpoint, never direct to a model
 provider:
@@ -214,14 +214,6 @@ territory, a manager sees all) resolves through
 identity, so the API cannot filter server-side. The realm's users
 (`admin-user`, `pm-user`, …) are role placeholders, not real employees.
 
-**The broker client is named after the middleware.** Every agent must request
-`kong-token-exchange-broker-audience` alongside the server's own audience, so
-the one thing an agent cannot avoid naming is the very thing it should not know
-about. Closing it means renaming the client and its scope in Keycloak, and
-following that rename through the gateway configuration, LibreChat and each
-agent's config. Until then, treat the string as an opaque identifier owned by
-the realm.
-
 ## Conventions
 
 - Deliverables in English: code, comments, READMEs, Agent Cards. Conversation