insika 0.1.0 → 0.2.0

data/lib/insika/frontmatter.rb

@@ -7,7 +7,7 @@ module Insika
   # The convention is YAML, but real packs carry PROSE in `description` — with `: `
   # (colon + space), quotes, parentheses — which STRICT YAML rejects
   # ("mapping values are not allowed in this context"). The OpenClaw gateway
-  # tolerates it; the insika has to tolerate it too (NF2: the same pack must hold).
+  # tolerates it; the insika has to tolerate it too (the same pack must hold).
   #
   # Strategy: try YAML (respects quoted / multi-line / lists); if the YAML
   # fails OR doesn't yield a Hash, fall back to a LINE-BY-LINE parse that splits on

data/lib/insika/golden_store.rb

@@ -5,7 +5,7 @@ require "time"
 require "yaml"
 
 module Insika
-  # AUTHORED eval cases (RFC-0008 §3.1, promoted to a store by RFC-0013 §3.7).
+  # AUTHORED eval cases (promoted to a store by).
   #
   # A golden case used to be a YAML file in `evals/golden/`, which means only someone
   # with a checkout and a text editor could add one. The rubric is the part of an eval
@@ -133,7 +133,7 @@ module Insika
     def case_hash(golden)
       h = { "id" => golden.id, "agent" => golden.agent, "turns" => golden.turns }
       h["requires"] = golden.requires unless golden.requires.empty?
-      # Same rule for `reference` (RFC-0014 §3.4): omitted when absent, never dropped
+      # Same rule for `reference`: omitted when absent, never dropped
       # when present. A case that lost its reference in a round-trip would stop being
       # compared against the incumbent and the report would look identical.
       h["reference"] = golden.reference unless golden.reference.empty?

data/lib/insika/http_client.rb

@@ -5,11 +5,11 @@ require "uri"
 require_relative "coercion"
 
 module Insika
-  # Default HTTP client for data-tools. Net::HTTP (stdlib, zero-dep — spec §10)
+  # Default HTTP client for data-tools. Net::HTTP (stdlib, zero-dep — spec)
   # with its own socket timeouts (mitigates reactor blocking even if the
-  # envelope timer doesn't fire) and a response-size CAP via streaming (NF2,
+  # envelope timer doesn't fire) and a response-size CAP via streaming (
   # avoids OOM). It is INJECTABLE: tests pass a double (none hit the network);
-  # Stage C can swap in async-http without touching DataDefinedTool.
+  # can swap in async-http without touching DataDefinedTool.
   #
   # Contract: request(method:, url:, headers:, body:, timeout:) -> { status:, body: }
   # (+ `location:` on a 3xx). It does NOT follow redirects: the destination is

data/lib/insika/inbound_log.rb

@@ -4,7 +4,7 @@ require "time"
 
 module Insika
   # Short-lived memory of inbound event ids, so a platform's retry does not become
-  # a second LLM turn and a second reply (RFC-0011 §6.4).
+  # a second LLM turn and a second reply.
   #
   # Every messaging platform retries a webhook it did not see acked in time, and a
   # relay consumer that hands us its own queue does the same. Without this, the

data/lib/insika/llm_configurator.rb

@@ -12,7 +12,7 @@ module Insika
   # matching accessor) does NOT blow up: it goes into `skipped` (degrades to "restart
   # recommended", like OpenClaw), the rest applies.
   #
-  # ⚠️ GOTCHA — the DEFAULT target is a global singleton (RubyLLM research, §10).
+  # ⚠️ GOTCHA — the DEFAULT target is a global singleton (RubyLLM research).
   # With no `configure:`, `apply`/`unapply` mutate the PROCESS-WIDE config
   # (`RubyLLM.config`). They are therefore admin operations (rare, operator-driven:
   # a provider key/base edit in the Studio), NOT a per-request/per-turn path — a
@@ -22,7 +22,7 @@ module Insika
   # MODEL per turn — the model is chosen at chat build time (ModelResolver ->
   # chat(model:)), never by mutating the global.
   #
-  # PER-GRAPH credentials are no longer hypothetical (RFC-0017 A2): the DSL runtime
+  # PER-GRAPH credentials are no longer hypothetical: the DSL runtime
   # passes `configure:` targeting its own `RubyLLM.context` — an isolated config dup
   # — so an operator's key edit in an EMBEDDED graph applies to that graph and stops
   # there. See `DSL::Runtime#llm_configure` and docs/EMBEDDING.md.
@@ -62,7 +62,7 @@ module Insika
     end
 
     # UNDOES a provider's config in RubyLLM at runtime (delete without a restart,
-    # §9.5): clears `<api>_api_key`/`<api>_api_base`. A provider that RubyLLM
+    # clears `<api>_api_key`/`<api>_api_base`. A provider that RubyLLM
     # doesn't recognize (no accessor) -> unapplied: false (nothing applied, nothing to undo).
     # -> { unapplied: bool }.
     def unapply(api)

data/lib/insika/loop_detector.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+module Insika
+  # loop detection by (tool, args) hash, with a ONE-SHOT intervention.
+  #
+  # `max_tool_calls` bounds how MANY tool calls a turn makes, not how useful they
+  # are: a model retrying the exact same call — same tool, identical arguments —
+  # after an empty or error result burns the whole budget doing something that
+  # was settled on the first repeat. This detector is the engine saying so, once.
+  #
+  # The streak is CONSECUTIVE and turn-scoped, like the max_tool_calls counter it
+  # sits next to in ChatBuilder#wire_callbacks: a call revisited much later in a
+  # long turn is not the pathology being caught, and semantic ("nearly the same")
+  # matching is how a guard-rail starts eating legitimate retries.
+  #
+  # Two invariants, both borrowed from SteerInjector, because the
+  # intervention is a `user` message appended mid-loop:
+  #
+  # · **Batch boundary only.** The append happens after the LAST tool result of a
+  #   batch closes — a `user` message between two tool results is rejected by
+  #   Anthropic outright. Same arithmetic: an assistant message opens a batch of
+  #   N, the Nth `role: tool` message closes it.
+  # · **A halted batch receives nothing.** With `halt_when` there is no next
+  #   model step; a warning appended there would sit unanswered forever.
+  #
+  # The repeated call itself STILL RUNS — fabricating a synthetic result would
+  # teach the model that tools lie (the failure refuses). The
+  # warning rides after the truth; only a repeat that arrives AFTER the warning
+  # was spent aborts, through the existing TimeoutError(stage: :tool_limit) path.
+  class LoopDetector
+    # The one intervention text, verbatim — a fixed engine sentence, so a report
+    # can identify it without an origin stamp (chat messages carry none).
+    def self.intervention(name, streak)
+      "You have called `#{name}` with identical arguments #{streak} times in a row and " \
+      "received the same result every time. Repeating it will not produce new information. " \
+      "Do not call it again with the same arguments — answer with what you already have, " \
+      "or change your approach."
+    end
+
+    # chat:  the turn's chat — must answer #add_message (the boundary append).
+    # limit: the streak that triggers the intervention (profile's
+    #        max_tool_repeat). Values < 2 mean OFF: a "streak of 1" is every
+    #        call, which is meaningless.
+    # emit:  ->(type, data) — the Executor's emitter, bound to the task.
+    def initialize(chat:, limit:, emit:)
+      @chat = chat
+      @limit = limit
+      @emit = emit
+      @last = nil          # fingerprint of the previous call (nil = none yet)
+      @streak = 0
+      @intervened = false  # the ONE warning of this turn has been delivered
+      @pending = false     # detection fired; waiting for the batch boundary
+      @expected = nil      # tool calls announced by the batch in flight
+      @seen = 0
+      @halted = false
+    end
+
+    # From ChatBuilder's before_tool_call. Raises BEFORE the call executes once
+    # the warning is spent — bounded spend is the point of aborting here.
+    def tool_call(name, arguments)
+      fingerprint = [name.to_s, canonical(arguments)]
+      if fingerprint == @last
+        @streak += 1
+      else
+        # A different call broke the run: the loop resolved itself, so a warning
+        # armed earlier is moot — it must not fire later naming the WRONG call.
+        @streak = 1
+        @pending = false
+      end
+      @last = fingerprint
+      return if @streak < @limit
+
+      if @intervened
+        raise Insika::TimeoutError.new(
+          "tool loop detected (#{name} repeated with identical arguments after a warning)",
+          stage: :tool_limit)
+      end
+      @pending = true
+    end
+
+    # From ChatBuilder's after_tool_result, with the RAW result — the only place
+    # a Tool::Halt is still recognizable (SteerInjector's comment applies here).
+    def tool_result(result)
+      @halted = true if defined?(RubyLLM::Tool::Halt) && result.is_a?(RubyLLM::Tool::Halt)
+    end
+
+    # RubyLLM after_message. An assistant message carrying tool calls OPENS a
+    # batch; the Nth tool result CLOSES it — the one boundary where appending
+    # is valid.
+    def message_ended(message)
+      role = field(message, :role).to_s
+      return open_batch(message) if role == "assistant"
+      return unless role == "tool" && @expected
+
+      @seen += 1
+      intervene! if @seen >= @expected
+    end
+
+    private
+
+    def open_batch(message)
+      calls = field(message, :tool_calls)
+      size = calls.respond_to?(:size) ? calls.size : 0
+      # No tool call = the model talking; the turn is ending and a pending
+      # warning is moot — the loop resolved itself.
+      return @expected = nil if size.zero?
+
+      @expected = size
+      @seen = 0
+      @halted = false
+    end
+
+    def intervene!
+      @expected = nil
+      return unless @pending
+      @pending = false
+      return if @halted # nothing will read it (halt_when): drop, never deliver
+
+      @intervened = true
+      name, = @last
+      @chat.add_message(role: :user, content: self.class.intervention(name, @streak))
+      # Counts and the tool name, never the arguments — order numbers are PII.
+      @emit.call(:tool_loop_intervened, { name: name, streak: @streak })
+    end
+
+    # (name, args) hash: symbols vs strings and key order must not split an
+    # identical call into two fingerprints. Compared with ==, never hashed.
+    def canonical(value)
+      case value
+      when Hash then value.map { |k, v| [k.to_s, canonical(v)] }.sort_by(&:first)
+      when Array then value.map { |v| canonical(v) }
+      else value
+      end
+    end
+
+    def field(message, name)
+      return message.public_send(name) if message.respond_to?(name)
+      return message[name] || message[name.to_s] if message.respond_to?(:[])
+
+      nil
+    end
+  end
+end

data/lib/insika/mcp_http_client.rb

@@ -3,19 +3,19 @@
 require "json"
 
 module Insika
-  # MINIMAL MCP client over HTTP JSON-RPC (Phase 7, Stage E). Discovers the tools
+  # MINIMAL MCP client over HTTP JSON-RPC. Discovers the tools
   # of an MCP instance with HTTP transport by making a JSON-RPC 2.0 `tools/list`
   # POST to the instance endpoint, behind the EgressGuard (SSRF — the url comes
-  # from editable config, NF4). It is the DEFAULT client injected into the
+  # from editable config). It is the DEFAULT client injected into the
   # McpToolIngestor; tests pass a Fake (duck-typed) in its place.
   #
   # Contract (MCP client duck-type): `#list_tools -> [{name, description,
   # inputSchema}]` — the same MCP envelope that the ToolManifest adapter normalizes.
   #
-  # SCOPE (bounded, D8): only the minimal handshake of ONE stateless `tools/list`
+  # SCOPE (bounded): only the minimal handshake of ONE stateless `tools/list`
   # POST. Does NOT implement the full MCP session lifecycle (initialize/protocol
   # negotiation/session-id/notifications) nor the stdio transport — that is the
-  # "real MCP transport", later work (out-of-scope, see spec §4 D8). It serves
+  # "real MCP transport", later work (out-of-scope, see spec). It serves
   # simple HTTP MCP servers (direct JSON-RPC) and proves the ingestion seam.
   class McpHttpClient
     JSONRPC_VERSION = "2.0"

data/lib/insika/mcp_tool_ingestor.rb

@@ -3,16 +3,16 @@
 require "json"
 
 module Insika
-  # LIVE MCP ingestion (Phase 7, Stage E / spec §4 D8): discovers the tools of an
+  # LIVE MCP ingestion (/ spec): discovers the tools of an
   # MCP instance at RUNTIME (no hand-written manifest) and ingests them as
   # data-tools. Given an McpStore instance + an INJECTABLE MCP client
   # (duck-typed: `#list_tools -> [{name, description, inputSchema}]`), it builds a
-  # ToolManifest and REUSES the Stage B ingestion path (the :import_tools Command:
+  # ToolManifest and REUSES the ingestion path (the:import_tools Command:
   # batch upsert into the ToolStore + hot reload + per-tool report + partial-
   # failure isolation R4). The ToolManifest MCP adapter (`inputSchema`) is reused
   # — no schema parsing here.
   #
-  # GENERIC (NF1): nothing here mentions achei/openclaw. The MCP instance is DATA in the store.
+  # GENERIC: nothing here mentions a consumer/gateway. The MCP instance is DATA in the store.
   #
   # BINDING STRATEGY (this stage's choice, bounded):
   #   Each discovered tool becomes an HTTP data-tool that makes a JSON-RPC 2.0
@@ -23,10 +23,10 @@ module Insika
   #   runs through the SAME HTTP path as the other data-tools (egress guard, secret
   #   headers, hot reload) — no new execution code.
   #
-  #   Each tool gets `group: "mcp:<instance>"` so the Stage C per-group gating
+  #   Each tool gets `group: "mcp:<instance>"` so the per-group gating
   #   (tools_allow_groups) works for free.
   #
-  # DEFERRED / OUT-OF-SCOPE (documented — spec §4 D8):
+  # DEFERRED / OUT-OF-SCOPE (documented — spec):
   #   - Real MCP transport: only instances with a `url` (http transport) are ingestible;
   #     stdio has no HTTP endpoint -> raises a clear error (later work).
   #   - MCP session lifecycle (initialize/negotiation/session-id/notifications) and the
@@ -65,7 +65,7 @@ module Insika
       if url.nil?
         raise Insika::ValidationError,
               "MCP instance '#{name}' has no url: live ingestion requires HTTP transport " \
-              "(stdio is later work — D8)"
+              "(stdio is later work)"
       end
 
       tools = Array((client || @client_factory.call(record)).list_tools)

data/lib/insika/message_origin.rb

@@ -7,11 +7,11 @@ module Insika
   # two come apart constantly:
   #
   # · The engine delivers an async subagent's result to the parent as a NEW turn
-  #   (RFC-0010) — a `user` message the engine wrote.
+  # a `user` message the engine wrote.
   # · A guardrail short-circuits with a safe reply — an `assistant` message produced
   #   with zero LLM calls.
   # · A consumer composes context blocks into the input it sends (`<memoria> …`,
-  #   `<cacau_cep_obrigatorio> …`) — a `user` message the customer never typed.
+  #   `<store_cep_required> …`) — a `user` message the customer never typed.
   # · In an imported transcript, a human operator types after a handoff — an
   #   `assistant` message no model produced.
   #

data/lib/insika/model_resolver.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Insika
-  # LLM config v2 resolution (FOLLOWUP §10). Turns the three config layers into a
+  # LLM config v2 resolution. Turns the three config layers into a
   # single ModelSelection at turn start:
   #
   #   Chat (per-session pin) > Agent (profile.model) > Platform default (Settings)

data/lib/insika/model_selection.rb

@@ -14,8 +14,9 @@ module Insika
   #                model / platform default is NOT pinned -> fallbacks apply.
   #   params    -> generation params (Hash of symbols: temperature/max_tokens/thinking)
   #   fallbacks -> ordered [{ model:, provider: }] to try when NOT pinned. The
-  #                mid-turn ROTATION across this chain is a follow-up; today the
-  #                chain is resolved + surfaced (source/pinned) for telemetry.
+  #                mid-turn ROTATION across this chain (plus the profile's own
+  #                reliability["fallback"] refs) is WS3's Reliability coordinator;
+  #                here the chain is resolved + surfaced (source/pinned) for it.
   ModelSelection = Data.define(:model, :provider, :source, :pinned, :params, :fallbacks) do
     def initialize(model:, provider: nil, source: :platform_default, pinned: false,
                    params: {}, fallbacks: [])
@@ -70,7 +71,7 @@ module Insika
       chat.with_params(**payload) unless payload.empty?
     end
 
-    # The resolved reasoning control (§10, 4-layer). Two axes folded into one field:
+    # The resolved reasoning control (4-layer). Two axes folded into one field:
     #   off              -> reasoning DISABLED (thinking:{type:disabled})
     #   on               -> reasoning ENABLED, provider-default effort
     #   low|medium|high  -> reasoning enabled at that effort (reasoning_effort)
@@ -105,7 +106,7 @@ module Insika
     def present?(v) = Insika::Coercion.present?(v)
   end
 
-  # The selectable reasoning values (§10, 4-layer). Blank/absent = inherit the
+  # The selectable reasoning values (4-layer). Blank/absent = inherit the
   # broader layer; these are the explicit choices. Shared with the Studio forms.
   # Defined on the class OUTSIDE the Data.define block on purpose: a constant
   # assigned inside the block would land in the enclosing lexical scope (Insika),

data/lib/insika/onboarding.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Insika
-  # LLM-first onboarding surface (item 20 / §5.6). The "Flue trick": the insika
+  # LLM-first onboarding surface. The "Flue trick": the insika
   # serves, from itself, a `start.md` addressed to the DEVELOPER'S OWN coding agent
   # ("Read <base>/start.md then help me build my first agent") plus a machine-readable
   # `/models.json` and the public docs mirrored as raw markdown. It is `rails new`
@@ -31,7 +31,7 @@ module Insika
     MODELS_SCHEMA_VERSION = 1
 
     # The PUBLIC docs allowlist, repo-relative: slug => path. Explicit on purpose —
-    # the gitignored internal docs (FOLLOWUP / techspec / TRANSLATION-TRACKER / …)
+    # the gitignored internal docs (/ TRANSLATION-TRACKER / …)
     # are NEVER here, so /docs can only ever serve OSS material. Kept in sync with the
     # tracked `.md` prose (README + docs/*.md).
     PUBLIC_DOCS = {

data/lib/insika/outbox_store.rb

@@ -4,11 +4,11 @@ require "securerandom"
 require "time"
 
 module Insika
-  # Durable record of one pending OUTBOUND reply (RFC-0011 §6.5). A Shape B
+  # Durable record of one pending OUTBOUND reply. A Shape B
   # channel answers out of band — the turn ends and the reply is POSTed to the
   # platform (or, for a relay, to the consumer's own callback) afterwards — so
   # "the answer exists but the recipient is not on this connection" is exactly
-  # the problem RFC-0010 Phase 2 already solved for async delegation. This store
+  # the problem already solved for async delegation. This store
   # is DelegationStore's shape with a different recipient, deliberately: a second
   # invention here would be a second thing to get wrong.
   #

data/lib/insika/overlay_tool_registry.rb

@@ -3,17 +3,16 @@
 module Insika
   # DYNAMIC tool registry: composes the CODE registry (base, built at boot,
   # immutable) with the DATA-DEFINED tools from the ToolStore. Drop-in for ToolRegistry —
-  # the Executor/ToolCatalog/ToolEnvelope only use entries/resolve/side_effect?. Phase 5,
-  # Step B / D2.
+  # the Executor/ToolCatalog/ToolEnvelope only use entries/resolve/side_effect?.,
   #
   # Rules:
   #   - COLLISION: the base (code) ALWAYS wins — a data-tool cannot hijack
   #     the name of a code tool (security, R3). The authoring Command also
   #     refuses to create with a colliding name (code_tool?), but the defense stays here.
   #   - HOT: `reload` re-reads the store and swaps the dynamic index atomically — a
-  #     new/edited data-tool takes effect on the next turn without a restart (F5), mirroring
+  #     new/edited data-tool takes effect on the next turn without a restart, mirroring
   #     SkillCatalog.reload. An in-flight turn has already captured the index.
-  #   - PARITY (NF1): empty ToolStore ⇒ entries/resolve/side_effect? identical to the
+  # PARITY: empty ToolStore ⇒ entries/resolve/side_effect? identical to the
   #     pure base. The base (config/wiring.rb) does not even use the overlay — zero regression.
   #
   # The data-tools enter as NORMAL Registry::Entry (optional: false) — they obey

data/lib/insika/pack.rb

@@ -3,11 +3,11 @@
 require "json"
 
 module Insika
-  # Provisioning pack (Phase 6/D4/F6): the PORTABLE form of an agent — a
+  # Provisioning pack: the PORTABLE form of an agent — a
   # manifest + the prompt files + the skills + the data-tool defs. It's what
   # `docs/prompt-base/06` describes as a workspace, here in a value object
   # consumable by the PackImporter (which emits the authoring Commands). GENERIC
-  # per project (NF1): the engine doesn't know achei-b2b — the pack is the contract.
+  # per project: the engine doesn't know any consumer — the pack is the contract.
   #
   #   config: Hash — manifest (AgentProfile.build attrs: id/model/provider/
   #           limits/metadata/tools_deferred/…). `id`/`model` required there.
@@ -16,7 +16,7 @@ module Insika
   #   skills: { "escalation-to-human" => "<SKILL.md>", ... } — 1 per skill.
   #   tools:  [ { ToolDefinition hash }, ... ] — the pack's data-tool defs.
   #
-  # Two sources: `from_h` (GatewayClient JSON — provisioning API, task 8) and
+  # Two sources: `from_h` (GatewayClient JSON — provisioning API) and
   # `from_dir` (a folder on disk per docs/prompt-base/06 — authoring/CLI).
   Pack = Data.define(:config, :files, :skills, :tools) do
     # Raw Hash (string|symbol keys) -> Pack. Tolerates both key conventions

data/lib/insika/pack_importer.rb

@@ -1,15 +1,15 @@
 # frozen_string_literal: true
 
 module Insika
-  # Pack importer (Phase 6/D4/F6, task 7): reads a Pack and emits the ALREADY
+  # Pack importer: reads a Pack and emits the ALREADY
   # existing authoring Commands — create_agent/update_agent + write_agent_file +
   # write_skill + write_data_tool — making an agent provisionable at runtime from
-  # a standardized pack. It's the piece that achei-b2b's `GatewayClient`/
-  # `ProvisionStore` triggers (via the provisioning API, task 8).
+  # a standardized pack. It's the piece a consumer's provisioning client
+  # triggers (via the provisioning API).
   #
-  # GENERIC (NF1): nothing here mentions achei-b2b — the pack is the contract. Tool
+  # GENERIC: nothing here mentions a consumer — the pack is the contract. Tool
   # names come from the PACK, so prompts<->tools stay consistent by construction
-  # (NF2). It doesn't write to the store directly: it only dispatches Commands on
+  # It doesn't write to the store directly: it only dispatches Commands on
   # the bus (the same transport discipline) + READS the ProfileSource to decide
   # create vs update.
   #
@@ -58,13 +58,15 @@ module Insika
     # its OWN pack (per-store isolation) and re-provisioning removes what left.
     #   - prompt_files = the pack's .md files (write_agent_file also registers;
     #     union is a no-op). Setting here makes the list authoritative (removes the ones that left).
-    #   - skills = the pack's skills/ dirs (explicit allowlist; [] if none in the
-    #     pack and config didn't declare any — never nil=all, which would leak
-    #     skills from other stores).
+    #   - skills = the pack's skills/ dirs (explicit allowlist; [] when the pack
+    #     has none — never nil=all, which would leak skills from other stores).
     #   - tools_allow = (config.tools_allow) ∪ (the pack's tool names) — guarantees
-    #     the agent can call its own data-tools (NF2).
+    #     the agent can call its own data-tools. [] when neither exists —
+    #     never nil=all: the ToolStore is GLOBAL, so a tool-less pack would
+    #     otherwise see every other store's tools (store A's pack calling
+    #     store B's set_location is exactly that leak).
     #   - tools_allow_groups = groups enabled by FLAG in the pack (see
-    #     #enabled_groups) — the per-flag schema CUT (Phase 7, Stage E / D5): only
+    #     #enabled_groups) — the per-flag schema CUT: only
     #     the tools of the enabled groups (union with tools_allow) go to the model;
     #     those of disabled groups are cut BEFORE the turn (resolves the OpenClaw
     #     tool-call waste, where the flag only exists in Rails).
@@ -72,24 +74,24 @@ module Insika
       attrs = pack.config.dup
       attrs[:id] = id
       attrs[:prompt_files] = pack.files.keys unless pack.files.empty?
-      attrs[:skills] = pack.skills.keys if pack.skills.any? || pack.config.key?(:skills)
+      attrs[:skills] = pack.skills.keys
 
       pack_tools = pack.tools.map { |t| tool_name(t) }
       allow = Array(pack.config[:tools_allow]).map(&:to_s) | pack_tools
-      attrs[:tools_allow] = allow unless allow.empty? && !pack.config.key?(:tools_allow)
+      attrs[:tools_allow] = allow
 
       groups = enabled_groups(pack.config)
       attrs[:tools_allow_groups] = groups unless groups.nil?
       attrs
     end
 
-    # PER-FLAG CUT (Phase 7, Stage E / D5, STATIC pilot): derives the agent's
+    # PER-FLAG CUT (/, STATIC pilot): derives the agent's
     # per-group allowlist from FLAGS declared in the pack config — DATA, never a
-    # core convention (NF1). The engine doesn't know "groceries_v2"/"b2b": the pack
+    # core convention. The engine doesn't know "groceries_v2"/"b2b": the pack
     # declares which GROUPS are enabled; the flag->group mapping is the
     # responsibility of provisioning/the pack, not the insika. Two forms (union):
     #   - `enabled_groups: ["default", "b2b"]`  — explicit list of ON groups.
-    #   - `flags: { "b2b" => true, "natura" => false }` — the flag key IS the group
+    #   - `flags: { "wholesale" => true, "outlet" => false }` — the flag key IS the group
     #     name; only the truthy ones enter (the false ones CUT the group).
     # Neither declared -> nil (no per-group cut; old behavior).
     # Explicit `[]` (empty enabled_groups, or all flags false) -> no group.

data/lib/insika/pending_action_store.rb

@@ -64,7 +64,7 @@ module Insika
     end
 
     # -> [PendingAction] every :pending across all tasks — the approvals inbox
-    # (§12 G5, Studio). Single O(n) scan (vs. open_for per task = O(n·m)); the
+    # (Studio). Single O(n) scan (vs. open_for per task = O(n·m)); the
     # UI resolves task context afterwards via TaskStore#find.
     def all_open
       @store.list(SCOPE, KEY_PREFIX).filter_map do |key|

data/lib/insika/plugin/loader.rb

@@ -209,7 +209,7 @@ module Insika
           @registries[:workflows].register(name, callable, plugin: @plugin_id, &block)
         end
 
-        # RFC-0011 §4.2 — a channel is an INSTANCE (it holds its credentials and its
+        # a channel is an INSTANCE (it holds its credentials and its
         # HTTP client), so unlike a tool there is no factory to defer. Declared-or-
         # ignored like the others: the id is a URL segment, and a plugin quietly
         # mounting a route nobody declared is exactly what the contract list prevents.
@@ -254,7 +254,7 @@ module Insika
 
           if kind == :workflow
             warn "[plugin #{@plugin_id}] capability '#{name}' (kind: workflow) registered without a consumer " \
-                 "in this slice — agent exposure is follow-up (P2B-01 L5)"
+                 "in this slice — agent exposure is follow-up"
           end
 
           @staged_capabilities << { capability: name, impl_name: impl_name, kind: kind,

data/lib/insika/policy/policy.rb

@@ -47,7 +47,7 @@ module Insika
       # Absorbs ToolRegistry#resolve as a policy: optional without
       # opt-in -> deny; tools_deny -> deny ("deny always wins"); tools_allow
       # with the semantics (nil = all; [] = ∅; [names] = final set).
-      # Phase 7/D4/F5 (Step C): `tools_allow_groups` UNIONS in the groups' tools
+      # `tools_allow_groups` UNIONS in the groups' tools
       # (the group is GIVEN in the Entry metadata). Both allowlists nil = all.
       class ToolAllowlist < Base
         def decide(request)

data/lib/insika/profile_source.rb

@@ -90,6 +90,7 @@ module Insika
         tools_allow: h[:tools_allow], tools_deny: h[:tools_deny] || [],
         tools_allow_groups: h[:tools_allow_groups],
         skills: h[:skills],
+        skills_eager: h[:skills_eager],
         context_providers: h[:context_providers],
         workflows_allow: h[:workflows_allow],
         policies: Array(h[:policies]).map(&:to_sym),
@@ -97,27 +98,32 @@ module Insika
         limits: symbolize_limits(h[:limits]),
         approvals_required: h[:approvals_required],
         capabilities: h[:capabilities],
-        # subagents (RFC-0010): allowlist of child ids; build re-normalizes to
+        # subagents: allowlist of child ids; build re-normalizes to
         # [String]. nil round-trips as nil (opt-in: NONE).
         subagents: h[:subagents],
         tools_deferred: h[:tools_deferred],
         memory: h[:memory],
         prompt_caching: h[:prompt_caching],
-        # params/model_policy (v2, §10): the resolver tolerates string keys from
+        tool_output_compression: h[:tool_output_compression],
+        # params/model_policy: the resolver tolerates string keys from
         # the JSON round-trip (ModelResolver#normalize_params / ModelPolicy), so no
         # re-symbolization needed here.
         params: h[:params] || {},
         model_policy: h[:model_policy],
-        # guardrails (RFC-0009): a plain Hash; Safety::Config tolerates the JSON
+        budget: h[:budget],
+        reliability: h[:reliability],
+        alerts: h[:alerts],
+        stuck_signal: h[:stuck_signal],
+        # guardrails: a plain Hash; Safety::Config tolerates the JSON
         # round-trip (string keys/values), so no re-symbolization here.
         guardrails: h[:guardrails],
-        # sandbox (item 35): a plain config Hash; Sandbox.build tolerates the JSON
+        # sandbox: a plain config Hash; Sandbox.build tolerates the JSON
         # round-trip (string keys), so no re-symbolization here. nil = absent.
         sandbox: h[:sandbox],
-        # refinement (RFC-0013): a plain config Hash read with string keys by the
+        # refinement: a plain config Hash read with string keys by the
         # RunRefinement handler; nil round-trips as nil (= report-only).
         refinement: h[:refinement],
-        # capabilities_declared (RFC-0014 §3.5): flat [String]; build re-normalizes.
+        # capabilities_declared: flat [String]; build re-normalizes.
         capabilities_declared: h[:capabilities_declared],
         # edge_stream: which internal channels may cross to the customer. {} = neither.
         edge_stream: h[:edge_stream],