insika 0.0.1 → 0.2.0

data/lib/insika/agent_file_store.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require "time"
+
+module Insika
+  # Per-agent workspace. Holds the
+  # CONTENT of each agent's prompt files (IDENTITY.md/SOUL.md/TOOLS.md
+  # and the like) in the durable Store — not on disk. It is what makes "each one
+  # builds its own BIA with its own identity": the Prompt provider reads from
+  # here, per agent, instead of the fixed `files:` in the wiring (which are now
+  # only the deployment default).
+  #
+  # One record per agent in the ConfigStore (scope "agent_files"):
+  #   { "files" => { "<name>" => { "content" => str,
+  #                                "updated_at" => iso8601,
+  #                                "history" => [ { "content" => str, "at" => iso8601 }, ... ] } } }
+  #
+  # A write versions: the previous content goes into `history` (most recent
+  # first), capped at HISTORY_MAX — restoring becomes a new write
+  # (preserves the linear history, no destructive "time travel").
+  class AgentFileStore
+    SCOPE = "agent_files"
+    HISTORY_MAX = 20
+
+    def initialize(config_store:)
+      @cs = config_store
+    end
+
+    # -> String | nil (current content; nil = nonexistent file/agent).
+    def read(agent_id, filename)
+      entry(agent_id, filename.to_s)&.fetch("content", nil)
+    end
+
+    # -> [String] the agent's file names, lexicographic order.
+    def list(agent_id)
+      files(agent_id).keys.sort
+    end
+
+    # -> [String] every agent that has a workspace here (what `doctor` sweeps).
+    def agents = @cs.keys(SCOPE).sort
+
+    # A prompt file is TEXT. `to_s` on a structured value produces Ruby's `#inspect`
+    # and stores it as if it were the prompt: the pilot lost all 11 files of its
+    # production agent that way (someone wrote an ENTRY back as content, so the
+    # markdown reached the model as `{"content" => "…\n…"}` on a single line, escapes
+    # and all, for three weeks). Nothing legitimate passes a Hash or an Array here, so
+    # this is the one place that has to refuse instead of coerce.
+    def self.text!(content, agent_id, filename)
+      return content if content.is_a?(String)
+      return content.to_s unless content.is_a?(Hash) || content.is_a?(Array)
+
+      raise Insika::ValidationError,
+            "content for '#{filename}' (agent '#{agent_id}') must be text, got #{content.class} — " \
+            "pass the file's markdown, not the store entry or a wrapper object"
+    end
+
+    # Writes (upsert). create_only: refuses to overwrite. Versions the previous
+    # content into history. -> Hash (the stored entry).
+    def write(agent_id, filename, content, create_only: false)
+      name = filename.to_s
+      content = self.class.text!(content, agent_id, name)
+      record = @cs.get(SCOPE, agent_id.to_s) || { "files" => {} }
+      record["files"] ||= {}
+      current = record["files"][name]
+      if create_only && current
+        raise Insika::ValidationError, "file '#{name}' already exists for agent '#{agent_id}'"
+      end
+
+      record["files"][name] = build_entry(content.to_s, current)
+      @cs.put(SCOPE, agent_id.to_s, record)
+      record["files"][name]
+    end
+
+    # -> bool (did it exist?). Removes the file; if the agent ends up with no files,
+    # keeps the empty record (cheap; deleting the agent handles the cleanup).
+    def delete(agent_id, filename)
+      name = filename.to_s
+      record = @cs.get(SCOPE, agent_id.to_s)
+      return false unless record && record.dig("files", name)
+
+      record["files"].delete(name)
+      @cs.put(SCOPE, agent_id.to_s, record)
+      true
+    end
+
+    # -> [ { "content" =>, "at" => } ] older versions, most recent first.
+    def versions(agent_id, filename)
+      entry(agent_id, filename.to_s)&.fetch("history", []) || []
+    end
+
+    # Restores version `index` from history as the current content (a new write:
+    # the current one goes to the top of history). -> Hash (entry) | raises if index
+    # invalid / file nonexistent.
+    def restore(agent_id, filename, index)
+      name = filename.to_s
+      hist = versions(agent_id, name)
+      i = Integer(index)
+      unless entry(agent_id, name)
+        raise Insika::NotFoundError, "file '#{name}' not found for agent '#{agent_id}'"
+      end
+      raise Insika::ValidationError, "version #{index} does not exist" if i.negative? || i >= hist.length
+
+      write(agent_id, name, hist[i]["content"])
+    end
+
+    private
+
+    def files(agent_id)
+      (@cs.get(SCOPE, agent_id.to_s) || {})["files"] || {}
+    end
+
+    def entry(agent_id, filename)
+      files(agent_id)[filename]
+    end
+
+    def build_entry(content, current)
+      history = current ? current.fetch("history", []) : []
+      if current
+        history = [{ "content" => current["content"], "at" => current["updated_at"] }] + history
+        history = history.first(HISTORY_MAX)
+      end
+      { "content" => content, "updated_at" => Time.now.utc.iso8601, "history" => history }
+    end
+  end
+end

data/lib/insika/agent_profile.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+require_relative "coercion"
+
+module Insika
+  # Single point of per-agent policy.
+  # ONE allowlist semantics for tools, skills, providers and workflows
+  # (nil = all [+ opt-in for optional tools]; [] = none for skills/allow;
+  # [names] = the final set; deny always wins) — a single rule, tested once.
+  #
+  # Deliberate EXCEPTION: `capabilities` does NOT follow the
+  # `nil = all` rule. nil/absent = NO capability (explicit opt-in — exposing
+  # every registered capability by mistake would couple the agent to plugins it
+  # didn't ask for). Do NOT "fix" it to be consistent with tools_allow.
+  AgentProfile = Data.define(
+    :id, :model, :provider,
+    :base_prompt, :prompt_files,
+    :tools_allow, :tools_deny,
+    :tools_allow_groups,              # per-GROUP allowlist:
+    #                                   union with tools_allow; deny wins; both
+    #                                   nil = all (parity). Expands to the group's
+    #                                   tools in the ToolAllowlist policy.
+    :skills,
+    :skills_eager,                    # progressive disclosure OFF, wholly or in part:
+    #                                   nil/false = level 1 + load_skill (parity); true = every
+    #                                   allowed skill; [names] = exactly these. An eager skill's
+    #                                   BODY enters the prompt each turn, it leaves the
+    #                                   <available_skills> catalog and load_skill refuses it.
+    #                                   Removes the activation DECISION (no miss rate) at the
+    #                                   cost of the bodies' tokens — measure them against
+    #                                   context_budget before turning it on. Same opt-in as
+    #                                   `memory`. It lives HERE and not in the SKILL.md
+    #                                   frontmatter because skills are shared between agents:
+    #                                   a per-skill flag forced one decision onto every
+    #                                   allowlist holding the skill. NOT `Allowlist`
+    #                                   semantics — nil means NONE here (SkillCatalog#eager_for).
+    :context_providers,               # provider allowlist
+    :workflows_allow,                 # applied by WorkflowAllowlist
+    :policies,                        # names in the Policy Registry
+    :prompt_refs,                     # names in the Prompt Catalog
+    :limits,                          # timeouts/budgets
+    :approvals_required,              # tools that require approval (ApprovalRequired)
+    :capabilities,                    # intents the agent can trigger.
+    #                                   nil = NONE (opt-in, see above).
+    :subagents,                       # allowlist of child agent ids this agent MAY spawn
+    # CAPACITY field — NEVER inherits;
+    #                                   opt-in like `capabilities`: nil/absent = NONE (do NOT
+    #                                   "fix" to nil = all). Present => the `spawn_subagent`
+    #                                   system tool is wired (ChatBuilder), gated by this set.
+    :tools_deferred,                  # searchable-not-wired tools (Tool Search).
+    #                                   nil = no deferred (all eager — parity);
+    #                                   [names] ⊆ allowed_tools, exposed via tool_search.
+    :memory,                          # cross-session memory.
+    #                                   nil/false = OFF (parity: provider []; the `remember`
+    #                                   tool not wired); true = ON. Same opt-in as capabilities.
+    :prompt_caching,                  # Anthropic prompt caching (R3): nil/false = OFF
+    #                                   (parity); true = ON. Same opt-in as `memory`. When ON
+    #                                   AND the resolved provider is Anthropic, ChatBuilder sets
+    #                                   ONE cache breakpoint at the end of the system block
+    #                                   (caches tools+system by the tools->system->messages
+    #                                   prefix order; immune to history eviction). PRE-AUDIT:
+    #                                   the system prompt MUST be byte-stable between turns —
+    #                                   a context provider injecting volatile content into
+    #                                   :system turns every turn into a paid cache WRITE with
+    #                                   no read hit. Enable only for stable-system agents.
+    :tool_output_compression,          # MECHANICAL tool-result dedupe in the replayed
+    #                                   history (A3/C3): nil/false = OFF (parity); true = ON.
+    #                                   Same opt-in as `memory`. When ON, the history the
+    #                                   Session provider seeds replaces byte-identical repeated
+    #                                   tool results with a compact back-reference (first
+    #                                   occurrence stays full) — no LLM involved. CHANGES WHAT
+    #                                   THE MODEL SEES: an older full result is only the first
+    #                                   occurrence; a model that wants an older detail re-calls
+    #                                   the tool. Cheap half of compaction for bloated histories.
+    :params,                          # LLM generation params: a Hash with
+    #                                   temperature/max_tokens/thinking, applied to the chat at
+    #                                   stage 5. {} = provider defaults (parity).
+    :budget,                          # spend caps per (tenant, agent) over
+    #                                   CALENDAR windows (WS2): { "daily" => int,
+    #                                   "monthly" => int, "soft" => bool, "alert_at" => 0.8 }.
+    #                                   HARD is the default: absent/"soft": false, a turn
+    #                                   arriving at/over the cap fails with Insika::BudgetExceeded
+    #                                   and the envelope quotes `budget_exceeded` + retry_after.
+    #                                   "soft": true crosses the cap and still runs
+    #                                   (one budget_warning event per window + a note in the
+    #                                   context).
+    #                                   Tokens count the billed spend (input+output+cached+
+    #                                   cache_creation). nil/absent = no budget (parity).
+    :reliability,                     # the provider-interaction reliability policy (WS3):
+    #                                   { "retries" => 3, "backoff" => "exponential",
+    #                                   "fallback" => ["gpt-4o-mini", ...],
+    #                                   "circuit_breaker" => { "after" => 10, "within" => 60,
+    #                                   "cooldown" => 300 }, "timeout" => 30 }. Data, never
+    #                                   DSL: retries + exponential backoff on :retryable /
+    #                                   :rate_limited_* failures (never :fatal), mid-turn
+    #                                   rotation across the fallback chain (profile's first,
+    #                                   then the platform's resolved fallbacks), and a circuit
+    #                                   breaker per (tenant, provider/model) that fail-fasts
+    #                                   with circuit_open + retry_after once the window count
+    #                                   trips. nil/absent = the plain single attempt (parity).
+    :alerts,                          # operator alert delivery (WS6): { "webhook" => url }.
+    #                                   When present, the agent's budget_warning /
+    #                                   breaker_open / delivery_failed events are POSTed to
+    #                                   the URL as JSON (outbox + claim, at-most-once).
+    #                                   nil/absent = no webhook (parity).
+    :stuck_signal,                    # the agent may signal it cannot proceed (WS5):
+    #                                   nil/false = OFF (parity — the signal_stuck system
+    #                                   tool is not wired); true = ON (the model may call
+    #                                   signal_stuck, which ends the turn with
+    #                                   `outcome: :stuck` + a final message + a :turn_stuck
+    #                                   event the consumer acts on). Same opt-in as
+    #                                   `memory`. What "stuck" MEANS is the consumer's call
+    #                                   (escalation via CRM/operator), never the engine's.
+    :model_policy,                    # governance of WHICH models the agent may use:
+    #                                   { "allow" => [refs] }. nil = NO fence (all models —
+    #                                   parity). Enforced on the RESOLVED model (ModelResolver).
+    :guardrails,                      # content-safety config: { input:, output:,
+    #                                   moderator:, strictness: }. OPT-IN like capabilities —
+    #                                   nil/absent = the conservative default (Safety::Config:
+    #                                   deterministic on, moderator off). Parsed, never a policy.
+    :sandbox,                         # confined-execution config:
+    #                                   { provider: "local"|"docker", root:, timeout:, ...+provider
+    #                                   keys }. Declarative provider selection (config-over-code) —
+    #                                   consumed by Insika::Sandbox.build. {} = absent (a
+    #                                   deployment builds a `local` sandbox by default). It is
+    #                                   CONFIG, never a policy — it does not decide security by
+    #                                   itself; the FS boundary + approvals do.
+    :refinement,                      # self-improvement config:
+    #                                   { mode: "report"|"propose"|"auto_apply", window: {…},
+    #                                   files: [allowlist], proposers: [refs], budget: {tokens:},
+    #                                   auto_apply_max_edits:, max_findings:, … }. nil/absent =
+    #                                   REPORT-ONLY (writes nothing to the agent, so
+    #                                   reading your own traces needs no opt-in); `propose`
+    #                                   and above must be enabled explicitly. It is CONFIG,
+    #                                   never a policy — the write allowlist it carries is
+    #                                   enforced by the applier, not by this field.
+    :capabilities_declared,           # FACTS ABOUT THIS DEPLOYMENT that are not tools
+    # %w[promotions human_handoff
+    #                                   b2b_pricing]. An eval case declares what it
+    #                                   `requires` and is SKIPPED — never failed — where
+    #                                   the deployment lacks it, which is what makes one
+    #                                   corpus usable across stores. A flat list the
+    #                                   OPERATOR writes: inferring "this store has
+    #                                   promotions" from data is how a suite starts lying.
+    #                                   nil/[] = declares nothing.
+    #                                   NOT `capabilities` above — that one is the
+    #                                   capability-resolution intents the agent may
+    #                                   trigger, a runtime allowlist. This one decides
+    #                                   nothing at runtime and is read only by the evals.
+    :edge_stream,                     # WHICH INTERNAL CHANNELS MAY CROSS TO THE CUSTOMER:
+    #                                   { "thinking" => bool, "intermediate" => bool }.
+    #                                   {} / absent = NEITHER, which is the safe default and
+    #                                   the reason the engine holds them back at all: the
+    #                                   answer is `:content`, and a turn's other text (the
+    #                                   provider's reasoning, the model narrating its tool
+    #                                   loop) is for the Studio and the trace. A product that
+    #                                   WANTS to show reasoning — a chat UI with a "thinking"
+    #                                   panel — opts in per agent, and each channel then gets
+    #                                   its OWN frame type at `/v1/responses`, never the
+    #                                   answer's. Turning it on for a channel where the
+    #                                   consumer concatenates every delta into one message
+    #                                   (WhatsApp) puts the deliberation in front of a
+    #                                   customer; that is the operator's call to make, not a
+    #                                   default to inherit.
+    :metadata                         # free-form agent metadata, stable per agent
+    #                                   (from the pack `agent.config.json`). Home of the `store_id`
+    #                                   that becomes turn context (ctx.store_id).
+    #                                   It is NOT a policy — never decides security. {} = absent.
+  )
+
+  # Reopened class (not a Data.define block): a constant assigned inside
+  # the block would leak into the lexical scope (Insika::DEFAULT_LIMITS).
+  class AgentProfile
+    DEFAULT_LIMITS = {
+      turn_timeout: 300, tool_timeout: 60, provider_timeout: 5,
+      context_budget: 8_000, max_tool_calls: 50,
+      # consecutive identical (tool, args) calls that trigger the ONE
+      # loop warning; a repeat after it aborts like max_tool_calls. < 2 = off.
+      max_tool_repeat: 3,
+      approval_timeout: 3_600, # cap on the wait for human approval (~1h)
+      # parallel tool calls. ONE number is both the switch and the cap
+      # (nil/0/1 = serial, the default; N > 1 = at most N tool calls in flight).
+      # It sits next to tool_timeout/max_tool_calls because it is the third bound
+      # on tool execution. Read through TurnState#tool_concurrency, which also
+      # applies the approval gate.
+      tool_concurrency: 1
+    }.freeze
+
+    # `model` is OPTIONAL as of v2: an agent without one resolves the
+    # platform `default_model` (Settings) at turn start via the ModelResolver.
+    def self.build(id:, model: nil, provider: nil, base_prompt: "", prompt_files: [],
+                   tools_allow: nil, tools_deny: [], tools_allow_groups: nil, skills: nil,
+                   skills_eager: nil, context_providers: nil, workflows_allow: nil,
+                   policies: [], prompt_refs: [], limits: {}, approvals_required: nil,
+                   capabilities: nil, subagents: nil, tools_deferred: nil, memory: nil,
+                   prompt_caching: nil, tool_output_compression: nil,
+                   params: {}, model_policy: nil, guardrails: nil, sandbox: nil,
+                   refinement: nil, capabilities_declared: nil, edge_stream: nil, metadata: {},
+                   budget: nil, reliability: nil, alerts: nil, stuck_signal: nil)
+      new(
+        id: id, model: model, provider: provider, base_prompt: base_prompt,
+        prompt_files: Array(prompt_files), tools_allow: tools_allow,
+        tools_deny: Array(tools_deny), tools_allow_groups: tools_allow_groups, skills: skills,
+        skills_eager: skills_eager,
+        context_providers: context_providers, workflows_allow: workflows_allow,
+        policies: Array(policies), prompt_refs: Array(prompt_refs),
+        limits: DEFAULT_LIMITS.merge(limits), approvals_required: approvals_required,
+        capabilities: capabilities,
+        # opt-in like capabilities: nil => NONE. Array-normalize a present value so
+        # readers get a clean [] and the ChatBuilder gate (present? => wire) is stable.
+        subagents: subagents.nil? ? nil : Array(subagents).map(&:to_s),
+        tools_deferred: tools_deferred, memory: memory,
+        prompt_caching: prompt_caching, tool_output_compression: tool_output_compression,
+        # The free-form hashes arrive with symbol keys (internal build) OR string
+        # keys (StoredProfileSource JSON round-trip). Normalize to string keys ONCE
+        # here — the single front door every profile passes through — so no reader
+        # downstream has to defend against both (store_id, model_policy, Studio forms).
+        params: Coercion.deep_stringify(params || {}),
+        model_policy: Coercion.deep_stringify(model_policy),
+        guardrails: Coercion.deep_stringify(guardrails),
+        sandbox: Coercion.deep_stringify(sandbox),
+        refinement: Coercion.deep_stringify(refinement),
+        # Flat [String] — the evals compare it against a case's `requires`, and a
+        # symbol/string mix there would be a silent miss.
+        capabilities_declared: Array(capabilities_declared).map(&:to_s),
+        edge_stream: Coercion.deep_stringify(edge_stream || {}),
+        metadata: Coercion.deep_stringify(metadata || {}),
+        budget: Coercion.deep_stringify(budget),
+        reliability: Coercion.deep_stringify(reliability),
+        alerts: Coercion.deep_stringify(alerts),
+        stuck_signal: stuck_signal
+      )
+    end
+
+    # opt-in for an optional tool = being in the agent's allow list.
+    def tool_opted_in?(name)
+      Array(tools_allow).include?(name)
+    end
+
+    # store_id of the turn context (ctx.store_id): lives in `metadata` (stable
+    # per store, comes from the pack). `build` string-keys metadata, so a plain
+    # string lookup is enough. nil = absent (the data-tool emits an empty header).
+    # It is NOT consumer-specific: `store_id` is a field of the turn-context contract
+    # generic per project.
+    def store_id = (metadata || {})["store_id"]
+
+    # May this channel (:thinking / :intermediate) cross to the customer? Tolerant
+    # of the string values a form or a pack round-trip produces ("1"/"true"), and
+    # of anything else being absent: the safe reading is the default one.
+    def stream_public?(channel)
+      v = (edge_stream || {})[channel.to_s]
+      Coercion.truthy?(v)
+    end
+  end
+end

data/lib/insika/alert_dispatcher.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+require "digest"
+require "time"
+
+module Insika
+  # Operator alerts to a webhook (WS6): the events `:budget_warning`,
+  # `:breaker_open` and `:delivery_failed` are answered per AGENT — a profile
+  # declaring `alerts: { "webhook" => url }` gets its alerts POSTed there as
+  # JSON. The delivery reuses the outbox + claim mechanism whole
+  # (`ChannelDelivery`): the handler only WRITES the outbox row; the existing
+  # tick sweep and boot recovery claim and POST it, at-most-once with bounded
+  # retry, via a registered `Channels::Webhook`. The engine transports the event
+  # and does not interpret it — a Slack/CRM adapter is the consumer's.
+  #
+  # Started as a child of the turn supervisor (like the tick) in serving mode;
+  # tests drive `handle` directly.
+  class AlertDispatcher
+    ALERT_TYPES = %i[budget_warning breaker_open delivery_failed].freeze
+
+    def initialize(event_stream:, outbox:, channels:, profiles:, task_store: nil, http:)
+      @event_stream = event_stream
+      @outbox = outbox
+      @channels = channels
+      @profiles = profiles
+      @task_store = task_store
+      @http = http
+      @webhook_ids = {} # url -> registered channel id (one webhook per URL)
+      # WS6 (boot recovery): webhook channels are derived from PROFILE config,
+      # not from events. Registering lazily (on the first alert) means a pending
+      # outbox row a crashed process left is swept at boot against an EMPTY
+      # registry and marked failed terminal. Pre-registering every configured
+      # URL at wiring time lets the boot sweep find the channel and deliver.
+      register_all_webhooks
+    end
+
+    # Serving: a long-lived consumer that answers every alert event. Drains on
+    # the supervisor fiber (blocks on the queue — no spin), exactly like the tick.
+    # It subscribes TYPED (only the alert events enter its queue — it answers
+    # payloads a full-traffic stream would otherwise overflow away) and, on an
+    # overflow close, RE-SUBSCRIBES: a consumer that never re-binds is how alerts
+    # stop in silence (WS6).
+    def start(parent:)
+      parent.async do |t|
+        t.annotate("insika-alerts")
+        loop do
+          subscription = @event_stream.subscribe(types: ALERT_TYPES)
+          subscription.each { |event| handle(event) }
+          # the subscription closed (its overflow path) — alerts must not die here
+        end
+      end
+      true
+    end
+
+    # The event -> outbox row. Cheap (one transactional write); the DELIVERY is
+    # the tick's job. Never raises: an alerting failure must not break the turn.
+    def handle(event)
+      type = event.type.to_s.to_sym
+      return unless ALERT_TYPES.include?(type)
+
+      agent = agent_for(event)
+      return if agent.nil?
+
+      profile = @profiles.respond_to?(:fetch) ? @profiles.fetch(agent.to_s) : nil
+      return if profile.nil?
+
+      url = profile&.respond_to?(:alerts) ? profile.alerts&.dig("webhook") : nil
+      return if Coercion.blank?(url)
+
+      record_alert(agent: agent.to_s, url: url.to_s, event: event)
+    rescue StandardError
+      nil
+    end
+
+    private
+
+    # The agent the alert belongs to: the event carries it for the alerts the
+    # engine emits with context (budget_warning / breaker_open); a
+    # delivery_failed resolves its task's command. Guards the loop: a webhook's
+    # OWN delivery failing is not re-alerted.
+    def agent_for(event)
+      case event.type.to_sym
+      when :delivery_failed
+        channel = event.data[:channel]
+        return nil if channel.to_s.start_with?("webhook:") # loop guard
+        agent_for_task(event.meta[:task_id])
+      else
+        event.data[:agent] || agent_for_task(event.meta[:task_id])
+      end
+    end
+
+    def agent_for_task(task_id)
+      return nil if task_id.nil? || @task_store.nil?
+
+      task = @task_store.find(task_id.to_s)
+      command = task&.respond_to?(:command) ? task.command : nil
+      return nil unless command.is_a?(Hash)
+
+      payload = command["payload"] || command[:payload] || {}
+      payload["agent"] || payload[:agent]
+    rescue StandardError
+      nil
+    end
+
+    # The event's durable record, as the CHANNEL would see it. `to` is the
+    # webhook URL; `payload` is the event itself (type/data/meta).
+    def record_alert(agent:, url:, event:)
+      channel = webhook_id(url)
+      @outbox.create(
+        channel: channel, to: url,
+        task_id: event.meta[:task_id], session_id: event.meta[:session_id],
+        payload: { "type" => event.type.to_s, "data" => event.data,
+                   "meta" => event.meta, "agent" => agent }
+      )
+    end
+
+    # One channel per URL, registered so ChannelDelivery.sweep can claim it.
+    def webhook_id(url)
+      @webhook_ids[url] ||= begin
+        id = "webhook:#{Digest::SHA1.hexdigest(url)[0, 8]}"
+        @channels.register(id, Channels::Webhook.new(url, http: @http))
+        id
+      end
+    end
+
+    # Boot face of `webhook_id`: register every configured URL up front (at
+    # wiring time, before the boot recovery's channel sweep runs). The url is
+    # PROFILE data, so it is known before any alert ever fires.
+    def register_all_webhooks
+      profiles = @profiles.respond_to?(:all) ? @profiles.all : []
+      profiles.each do |profile|
+        next unless profile&.respond_to?(:alerts)
+
+        url = profile.alerts&.dig("webhook")
+        webhook_id(url.to_s) unless Coercion.blank?(url)
+      end
+    end
+  end
+end

data/lib/insika/allowlist.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Insika
+  # Profile allowlist semantics, defined once: nil = all; [] = none;
+  # [names] = subset. It used to be copied in the Builder, the SkillCatalog and the
+  # policies — the rule must live in a single place.
+  module Allowlist
+    module_function
+
+    # Filters a collection by the allowlist, comparing `key.call(candidate)` (or the
+    # candidate itself) against the allowed names.
+    def filter(candidates, allow, &key)
+      return candidates if allow.nil?
+      return [] if allow.empty?
+
+      names = Array(allow).map(&:to_s)
+      candidates.select { |c| names.include?((key ? key.call(c) : c).to_s) }
+    end
+
+    # Per-item boolean variant (to compose with other filters in a select).
+    def allows?(allow, value)
+      return true if allow.nil?
+      return false if allow.empty?
+
+      Array(allow).map(&:to_s).include?(value.to_s)
+    end
+  end
+end

data/lib/insika/baseline_store.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "time"
+
+module Insika
+  # The ACCEPTED state of an agent's golden set (promoted to a store
+  # by). One record per agent in the ConfigStore (scope "baselines"):
+  #
+  #   { "at" => iso8601, "cases" => { "<case id>" => { "pass" => bool, "score" => n } } }
+  #
+  # Exactly the shape `Evals::Baseline.snapshot` already produces, so the file and
+  # the record are the same document in two places — no converter to keep honest,
+  # the same discipline `GoldenStore` applies to the corpus.
+  #
+  # **Why it had to leave the file.** `evals/baseline.json` works fine for the CLI,
+  # which runs from a checkout. The refinement gate does not: it runs inside a
+  # Railway deployment, scores a throwaway clone against the accepted state, and
+  # there is no checkout there to read. A gate that fell back to "no baseline found,
+  # nothing regressed" would be the most dangerous default in the system — so the
+  # baseline became a per-agent record, and the gate refuses when it is missing.
+  #
+  # The file stays the export format and the seed for a fresh deploy
+  # (`insika evals:baseline import|export`), for the same reason the goldens' YAML
+  # does. It is also still what `evals/run.rb --gate` reads for the pre-merge check,
+  # which is a checkout-side job and should stay one.
+  #
+  # Per AGENT and not one blob, unlike the file: a deployment serves many agents, a
+  # refinement run is about exactly one, and re-baselining the store after fixing
+  # agent A must not silently accept agent B's current state.
+  class BaselineStore
+    SCOPE = "baselines"
+
+    def initialize(config_store:)
+      @cs = config_store
+    end
+
+    # -> { "at" =>, "cases" => {…} } | nil. nil means NOT RECORDED, which every
+    # caller must treat as "cannot gate", never as "nothing regressed".
+    def get(agent_id)
+      @cs.get(SCOPE, agent_id.to_s)
+    end
+
+    # -> the stored record. `snapshot` is `Evals::Baseline.snapshot` output (or the
+    # equivalent hash); `at` is stamped here when the snapshot carries none.
+    def put(agent_id, snapshot, at: nil)
+      raw = Coercion.deep_stringify(snapshot || {})
+      cases = raw["cases"]
+      raise Insika::ValidationError, "baseline needs a 'cases' mapping" unless cases.is_a?(Hash)
+
+      record = { "at" => Coercion.presence(raw["at"]) || at || timestamp, "cases" => cases }
+      @cs.put(SCOPE, agent_id.to_s, record)
+      record
+    end
+
+    # -> bool (did it exist?). Removing a baseline disables the gate for that agent,
+    # which is the honest consequence and not a side effect worth hiding.
+    def delete(agent_id) = !!@cs.delete(SCOPE, agent_id.to_s)
+
+    # -> [String] agents with a recorded baseline.
+    def agents = @cs.keys(SCOPE)
+
+    # How many cases the accepted state covers. `0` and `nil` are different answers:
+    # nil = never recorded, 0 = recorded and empty (every case was skipped), and only
+    # the first is a configuration mistake.
+    def size(agent_id)
+      record = get(agent_id)
+      record && (record["cases"] || {}).size
+    end
+
+    private
+
+    def timestamp = Time.now.utc.iso8601
+  end
+end