insika 0.1.0 → 0.3.0

data/lib/insika/server/boot.rb

@@ -52,12 +52,12 @@ module Insika
         Sync { do_recovery }
       end
 
-      # Task recovery THEN delegation recovery (RFC-0010 Fase 2): the delegation
+      # Task recovery THEN delegation recovery: the delegation
       # sweep re-delivers completed-but-undelivered async delegations, and depends
       # on the task sweep having re-dispatched any in-flight children first. Both
       # create task fibers, so both must run inside the reactor scope of run_recovery.
       #
-      # The TASK sweep is additionally gated per boot generation (RFC-0016 E2):
+      # The TASK sweep is additionally gated per boot generation:
       # its "orphaned :running" test cannot see a sibling worker's live fiber, so
       # only the worker that claims the generation sweeps — the others would steal
       # in-flight turns. The delegation and channel sweeps stay ungated: each of
@@ -89,7 +89,7 @@ module Insika
         log("boot: delegations re-delivered — #{Array(result && result[:delivered]).size}")
       end
 
-      # RFC-0011 §6.5: replies a previous process committed but never handed to the
+      # replies a previous process committed but never handed to the
       # channel. Runs AFTER the task recovery for the same reason the delegation
       # sweep does — a resumed turn writes its own outbox record at its terminal, and
       # sweeping first would miss it.
@@ -108,7 +108,7 @@ module Insika
         return if @wiring.durable?
 
         log("boot: WARNING — EPHEMERAL backend (no INSIKA_DB): recovery will " \
-            "not resume anything after a restart (doc 02 §6).")
+            "not resume anything after a restart.")
       end
 
       def log(message)

data/lib/insika/server/rack_app.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# RFC-0017 A3 — the /v1 transport as a VALUE the host app mounts, instead of a
+# the /v1 transport as a VALUE the host app mounts, instead of a
 # server the engine starts.
 #
 #   mount Insika::Server.rack_app(INSIKA, token: ENV.fetch("INSIKA_TOKEN")), at: "/ai"
@@ -11,7 +11,7 @@
 # server boot now calls this instead of inlining it, which is what keeps the two
 # from drifting.
 #
-# The Studio is deliberately NOT part of this (the embed contract, item 4): it is
+# The Studio is deliberately NOT part of this (the embed contract): it is
 # a class-level singleton, so it is one per process, and a host that wants the
 # operator UI mounts `Studio::App` itself and accepts that limitation.
 
@@ -42,29 +42,42 @@ module Insika
       end
 
       attr_reader :token
+      attr_reader :graph
+      # the frozen criterion, memoized when the relay runs in shadow —
+      # nil otherwise. Loaded ONCE at boot (the refusal below), then shared.
+      attr_reader :criterion
 
       def app
+        tenancy = @config[:tenancy] || ENV["INSIKA_TENANCY"] || "single_tenant"
+        # WS1: the token store is handed over ONLY in multi_tenant mode — in
+        # single_tenant the classic gateway token is the only credential
+        # (passing the store would silently widen the surface).
+        store = tenancy == "multi_tenant" ? @graph.token_store : nil
         @app ||= Insika::Server::App.new(
           command_bus: @graph.bus, event_stream: @graph.event_stream,
           session_store: @graph.session_store, task_store: @graph.task_store,
           pending_action_store: @graph.pending_action_store,
           provisioner: Insika::PackImporter.new(bus: @graph.bus, profiles: @graph.profiles),
           # GET /v1/agents/:id — the read-only capability view a case's `requires`
-          # resolves against (RFC-0014 §3.2).
+          # resolves against.
           profiles: @graph.profiles,
-          # Item 20 / §5.6: the OSS onboarding surface (start.md + models.json + docs).
+          # the OSS onboarding surface (start.md + models.json + docs).
           # This is the primary "build my first agent" target — models.json reports the
           # DSL's stores + the agents this process serves (each id IS the `model`).
           onboarding: build_onboarding,
-          # Item 22: GET /v1/workflows + POST /v1/workflows/:name, opt-in by
+          # GET /v1/workflows + POST /v1/workflows/:name, opt-in by
           # injection like every other edge — nil when the system declares none,
           # so the routes simply do not exist (404, parity).
           workflow_registry: (@graph.workflow_registry if workflows?),
-          # RFC-0011: the bundled relay, when the env turns it on. Same rule as the
+          # the bundled relay, when the env turns it on. Same rule as the
           # OTEL bridge — a feature only `config.ru` can reach is a feature the
           # docs are half-true about.
           channels: (@graph.channel_registry if channels?),
-          config: { gateway_token: @token }.merge(@config)
+          config: { gateway_token: @token, tenancy: tenancy }.merge(@config),
+          token_store: store,
+          outcome_store: @graph.outcome_store,
+          # a 500's error_ref must be findable in the process log.
+          logger: $stdout
         )
       end
 
@@ -79,6 +92,17 @@ module Insika
             allow_http: Insika::EnvSchema.truthy?(ENV["INSIKA_EGRESS_ALLOW_HTTP"]),
             allow_private: Insika::EnvSchema.truthy?(ENV["INSIKA_EGRESS_ALLOW_PRIVATE"])
           )
+          # NO criterion, no shadow — enforced at boot, not per
+          # turn. Raises ConfigError when the file is missing, unparseable, or
+          # incomplete; the criterion is memoized here and injected into
+          # ChannelDelivery (its sha stamps every pair our half records).
+          if relay&.shadow?
+            criterion_path = Insika::EnvSchema.read("INSIKA_PARITY_CRITERION")
+            raise Insika::ConfigError, "shadow mode requires INSIKA_PARITY_CRITERION (the frozen criterion)" if criterion_path.nil?
+
+            @criterion = Insika::Parity::Criterion.load(criterion_path)
+            @graph.channel_delivery&.criterion_sha = @criterion.sha
+          end
           @graph.channel_registry.register(relay.id, relay) if relay
 
           widget = Insika::Channels::Web.from_env(

data/lib/insika/server/responses.rb

@@ -4,9 +4,8 @@ require "json"
 
 module Insika
   module Server
-    # OpenAI Responses edge adapter (`/v1/responses`) — the contract that the
-    # OpenClaw gateway consumers already speak (see achei-b2b
-    # `CoreServices::OpenclawDispatcher`). Phase 6, Step A.
+    # OpenAI Responses edge adapter (`/v1/responses`) — the contract that
+    # OpenClaw gateway consumers already speak.
     #
     # PURE module (no state, no framework): (a) translates the OpenAI
     # Responses request → `:send_message` payload; (b) maps each turn Event →
@@ -26,7 +25,7 @@ module Insika
       # `origin` is the consumer declaring WHO wrote the input it is sending. It
       # matters here more than anywhere: this adapter's `input` is a STRING the
       # consumer already composed out of context blocks plus the customer's text
-      # (`<memoria> …`, `<cacau_cep_obrigatorio> …`), so a transcript reader cannot
+      # (`<memoria> …`, `<store_cep_required> …`), so a transcript reader cannot
       # tell the two apart — the first refinement run over real traffic reported 219
       # "the customer repeated themselves" that were the engine reading its own
       # fragment back. A consumer that sends `origin: "engine"` on a composed turn
@@ -41,10 +40,45 @@ module Insika
         raise Insika::ValidationError, "user missing" if user.strip.empty?
 
         message = extract_input(body[:input])
-        raise Insika::ValidationError, "input empty" if message.strip.empty?
 
         out = { agent: agent.strip, user: user, message: message }
         (origin = Insika::MessageOrigin.parse!(body[:origin])) && (out[:origin] = origin)
+        # WS8: the optional customer_key — per-customer memory scope + purge handle
+        (customer = Insika::Coercion.presence(body[:customer])) && (out[:customer] = customer)
+        # WS9: the multimodal OPENAI shape — `input` as an array of content parts
+        # ({type: text/image/audio}) is preserved additively alongside the
+        # joined text; a string input stays byte-identical to before. The
+        # CONTRACT is enforced here (422) — the engine stays lenient.
+        raw = body[:input]
+        if raw.is_a?(Array)
+          unless Insika::Media.well_formed?(raw)
+            raise Insika::ValidationError,
+                  "malformed content part — each part must be {type: text|image|audio} with text/url"
+          end
+
+          normalized = Insika::Media.parts(raw).map do |p|
+            { "type" => p.type, "text" => p.text, "url" => p.url }.compact
+          end
+          out[:parts] = normalized unless normalized.empty?
+        end
+        # The turn needs SOMETHING to be about — text, or media the engine will
+        # turn into text (a voice note) or show the model (a photo). Checked
+        # after the parts are known, because the anchor use case (a WhatsApp
+        # voice note, no caption) carries no text at all and joining only the
+        # text parts made it a 422 at the door.
+        if message.strip.empty? && Array(out[:parts]).none? { |p| p["type"] != "text" }
+          raise Insika::ValidationError, "input empty"
+        end
+        # WS9: `source` marks pre-transcribed voice text; anything else is refused.
+        unless body[:source].nil? || body[:source].to_s == "voice"
+          raise Insika::ValidationError, 'source must be "voice"'
+        end
+        out[:source] = body[:source].to_s if Insika::Coercion.presence(body[:source])
+        # WS9 (saída): the channel declares which generated media it can
+        # RECEIVE ({ capabilities: ["image_output", "audio_output"] }). Additive
+        # + additive sibling on the completed frame; the exact capabilities are
+        # validated at the boundary (message_flow), not here.
+        (channel = body[:channel]) && (out[:channel] = channel)
         out
       end
 
@@ -84,8 +118,8 @@ module Insika
           # The provider's reasoning. Internal unless the AGENT opted in
           # (`edge_stream thinking: true`), which tags the event. Even then it does
           # NOT become answer text: it gets the Responses reasoning frame, so a
-          # consumer that only accumulates `output_text` deltas — achei-b2b's
-          # dispatcher, which turns them into one WhatsApp message — is unaffected,
+          # consumer that only accumulates `output_text` deltas — a dispatcher
+          # that turns them into one WhatsApp message — is unaffected,
           # and one that renders reasoning has something to render.
           if public_delta(event)
             sse("response.reasoning_summary_text.delta",
@@ -108,13 +142,19 @@ module Insika
                 { type: "insika.intermediate.delta", delta: event.data[:delta].to_s })
           end
         when :guardrail_blocked, :guardrail_flagged
-          # RFC-0009: audit events with no OpenAI Responses counterpart. On a BLOCK
+          # audit events with no OpenAI Responses counterpart. On a BLOCK
           # the safe reply still reaches the consumer through the normal :content
           # deltas + :task_completed path (the turn completes gracefully), so there
           # is nothing extra to translate here — the events live in /v1/events + the
           # Studio + the trace. Explicit (not a fall-through) to keep the closed
           # catalog honest.
           nil
+        when :ttft
+          # the live TTFB signal (WS6, INSIKA_TURN_TIMING opt-in): the provider's
+          # ms-to-first-token, emitted when the first content chunk arrives.
+          # Namespaced insika.* — no OpenAI Responses counterpart; unknown types
+          # are ignored, the safe failure.
+          sse("insika.ttft", { type: "insika.ttft", ttft_ms: event.data[:ttft_ms].to_i })
         end
       end
 
@@ -133,9 +173,18 @@ module Insika
           response[:usage] = usage.reject { |k, _| k.to_s == "model" }
           response[:model] = model if model
         end
-        # Opt-in per-turn latency breakdown (INSIKA_TURN_TIMING; item 34). Absent
+        # Opt-in per-turn latency breakdown (INSIKA_TURN_TIMING). Absent
         # by default — a non-standard sibling used only for TTFB diagnostics.
         (timing = event.data[:timing]) && (response[:timing] = timing)
+        # WS5 stuck signal: an additive sibling the terminal frame carries when the
+        # agent ended the turn declaring it cannot proceed. Consumers that only read
+        # the OpenAI-shaped response.use it to run their escalation ("stuck" means
+        # what they decide it means, never the engine's business).
+        (outcome = event.data[:outcome]) && (response[:outcome] = outcome.to_s)
+        # WS9 (saída): generated media parts (image/audio clips) ride the
+        # completed frame additively next to the text — absent when none were
+        # generated. The base64 bytes are the consumer's to render/upload.
+        (parts = event.data[:output_parts]) && (response[:output_parts] = parts)
         sse("response.completed", { type: "response.completed", response: response })
       end
 

data/lib/insika/server/tenant_auth.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "rack"
+require "rack/utils"
+
+module Insika
+  module Server
+    # Edge resolution for WS1 (multi-tenant): `Authorization: Bearer <token>` ->
+    # a principal `{ role:, tenant_id: }`, resolved BEFORE the routes. Two modes,
+    # one gate:
+    #
+    #   single_tenant (default) — no token store: the classic single operator
+    #     credential (config[:gateway_token]) is the only thing that resolves.
+    #   multi_tenant — tokens live in the TokenStore (per-tenant + operator).
+    #     A configured gateway_token STILL resolves as operator (an existing
+    #     deployment switching modes keeps its credential — additive, never
+    #     a second-class path).
+    #
+    # Fail-closed BY CONSTRUCTION: no store and no configured token -> :disabled
+    # (503, never open). A revoked or unknown token -> :unauthorized. Pure module,
+    # testable without a Rack env.
+    module TenantAuth
+      module_function
+
+      # gateway_token: config[:gateway_token] | nil. token_store: TokenStore |
+      # nil. header: raw Authorization value.
+      # -> :disabled | :unauthorized | { role: "operator"|"tenant", tenant_id: }
+      def check(gateway_token, token_store, header)
+        # Fail-closed FIRST (the construction rule): with no store AND no
+        # configured token the gateway is DISABLED (503) however the request
+        # looks — never "401: who are you facing a door that does not exist".
+        # A token_store present means the gateway IS configured (multi_tenant),
+        # with or without the legacy gateway token.
+        return :disabled if token_store.nil? && (gateway_token.nil? || gateway_token.empty?)
+
+        provided = header.to_s[/\ABearer (.+)\z/, 1]
+        return :unauthorized if provided.nil?
+
+        if token_store
+          record = token_store.resolve(provided)
+          unless record
+            # store miss -> the legacy gateway token still resolves as operator
+            # (an existing deployment switching modes keeps its credential).
+            return :unauthorized if gateway_token.nil? || gateway_token.empty?
+            return :unauthorized unless Rack::Utils.secure_compare(gateway_token, provided)
+
+            return { role: "operator", tenant_id: nil }
+          end
+
+          return { role: record.role.to_s, tenant_id: record.tenant_id }
+        end
+
+        # classic mode (no store): the gateway token is the only credential.
+        # Constant-time comparison: the operator token doesn't leak via timing.
+        return :unauthorized unless Rack::Utils.secure_compare(gateway_token, provided)
+
+        { role: "operator", tenant_id: nil }
+      end
+    end
+  end
+end

data/lib/insika/session_actor.rb

@@ -17,7 +17,7 @@ module Insika
   # Executor) is also born on the supervisor; the SessionActor only AWAITS it to
   # serialize.
   #
-  # RFC-0015: it is also where an inbound message for a BUSY session is routed.
+  # it is also where an inbound message for a BUSY session is routed.
   # That decision belongs here and nowhere else — this is already the object that
   # owns "one turn at a time for this session". Putting it in the HTTP handler
   # would duplicate the invariant; putting it in the Executor would mix turn
@@ -40,12 +40,16 @@ module Insika
     #
     # `policy` (a QueuePolicy) opens the debounce window for this turn; nil or a
     # policy without a window behaves exactly as before — dequeued and run at once.
-    def enqueue(task, profile:, resume_from: nil, policy: nil)
-      @queue.enqueue([task, profile, resume_from, policy])
+    #
+    # `timing`  is the channel clock a channel turn allocated at 202
+    # acceptance and already stamped `:inbound`; it rides the queue so the debounce
+    # window and the FIFO wait land INSIDE first_balloon_ms.
+    def enqueue(task, profile:, resume_from: nil, policy: nil, timing: nil)
+      @queue.enqueue([task, profile, resume_from, policy, timing])
       task.id
     end
 
-    # RFC-0015 §5.3 — merge a fragment into the turn waiting at the door.
+    # merge a fragment into the turn waiting at the door.
     # -> the task id it joined, or nil when there is nothing to merge into (no
     # pending turn, the window has closed, or the turn already started). nil is
     # the caller's signal to create a task of its own.
@@ -99,12 +103,12 @@ module Insika
 
     def run_loop
       loop do
-        task, profile, resume_from, policy = @queue.dequeue # blocks when empty
+        task, profile, resume_from, policy, timing = @queue.dequeue # blocks when empty
         task = hold_at_the_door(task, policy)
         @running = true
         @current_task = task
         begin
-          @executor.run_serial(task, profile: profile, resume_from: resume_from)
+          @executor.run_serial(task, profile: profile, resume_from: resume_from, timing: timing)
         rescue StandardError
           # run_serial already maps turn errors; this rescue is defense: an
           # unexpected error must NEVER bring down the session loop (Async::Stop <
@@ -117,7 +121,7 @@ module Insika
       end
     end
 
-    # RFC-0015 §5.3 — the debounce window. Sleeps on the LOOP's fiber, never on the
+    # the debounce window. Sleeps on the LOOP's fiber, never on the
     # request's, so the POST is acked immediately and the platform does not retry.
     # Returns the task to run (re-read from the store when fragments merged into it,
     # since the in-memory Task is a frozen snapshot of an older message).

data/lib/insika/session_store.rb

@@ -23,7 +23,14 @@ module Insika
     KEY_PREFIX = "session:"
 
     Session = Data.define(:id, :messages, :vars, :memory_refs,
-                          :created_at, :updated_at)
+                          :created_at, :updated_at, :briefing, :evidence) do
+      # Trailing members with defaults: an old record without the "briefing" /
+      # "evidence" keys reads as empty/nil without a migration.
+      def initialize(id:, messages:, vars:, memory_refs:, created_at:, updated_at:,
+                     briefing: nil, evidence: nil)
+        super
+      end
+    end
 
     # store: any Insika::Store (Memory, SQLite, ...) — injected by the
     # composition root (config/wiring.rb). SessionStore does not know the
@@ -44,6 +51,8 @@ module Insika
         "messages" => [],
         "vars" => deep_stringify(vars),
         "memory_refs" => [],
+        "briefing" => { "fields" => {}, "next_step" => nil },
+        "evidence" => { "ids" => [], "ungrounded" => 0 },
         "created_at" => now,
         "updated_at" => now
       }
@@ -61,7 +70,7 @@ module Insika
     # fiber, without a lock. Each message gets an "at" (ISO8601 UTC) if not
     # provided. NotFoundError if the session does not exist.
     #
-    # CONCURRENCY LIMITATION (§11 R2c): the RMW (read record -> += -> set) is
+    # CONCURRENCY LIMITATION (R2c): the RMW (read record -> += -> set) is
     # atomic ONLY because the SessionActor serializes turns of the same session
     # (one owner at a time). That serialization exists solely in SUPERVISED mode
     # (the actor loop lives on the supervisor). Two concurrent send_message on the
@@ -89,6 +98,58 @@ module Insika
       to_session(record)
     end
 
+    # appends this turn's evidence (ids + ungrounded delta) to the
+    # session record. RMW like append_messages — the SessionActor serializes
+    # same-session turns; the copy is in the method comment.
+    def append_evidence(id, ids:, ungrounded:)
+      record = fetch!(id)
+      ev = record["evidence"] ||= { "ids" => [], "ungrounded" => 0 }
+      fresh = (ev["ids"] + Array(ids).map(&:to_s).reject(&:empty?)).uniq.last(EvidenceLedger::MAX_IDS)
+      ev["ids"] = fresh
+      ev["ungrounded"] = ev["ungrounded"].to_i + ungrounded.to_i
+      record["updated_at"] = timestamp
+      @store.set(SCOPE, key_for(id), record)
+      to_session(record)
+    end
+
+    # -> Session. Upsert ONE briefing field. The pack owns the schema; the
+    # engine validates nothing about field NAMES here (the tools do, at the
+    # write edge). value is a String (anything else -> to_s); a BLANK value
+    # (after strip) REMOVES the key — absence means "not yet asked" (
+    # D4). NotFoundError if the session does not exist.
+    #
+    # CONCURRENCY NOTE: an unlocked RMW (read -> mutate -> set), like
+    # append_messages — but the SessionActor argument does NOT apply here. A
+    # briefing writer is a system tool, never enveloped, and with
+    # tool_concurrency > 1 the gem runs each call in its OWN fiber — outside the
+    # actor's per-session turn serialization. The RMW is still safe, for a
+    # different reason: nothing in the read/mutate/set path suspends. Store
+    # get/set are synchronous (the SQLite write semaphore is a non-yielding fast
+    # path when free), and a fiber only switches at a scheduler suspension point
+    # — so no other writer can interleave mid-RMW (measured: N concurrent
+    # writers lose nothing). It holds ONLY while that path never suspends; an
+    # async store (a real yield in get/set) would need a lock or CAS.
+    def update_briefing(id, field:, value:)
+      record = fetch!(id)
+      briefing = record["briefing"] ||= { "fields" => {}, "next_step" => nil }
+      value = Coercion.presence(Coercion.utf8(value.to_s))
+      value ? briefing["fields"][field.to_s] = value : briefing["fields"].delete(field.to_s)
+      record["updated_at"] = timestamp
+      @store.set(SCOPE, key_for(id), record)
+      to_session(record)
+    end
+
+    # -> Session. Upsert the agreed next step; a blank text clears to nil
+    # NotFoundError if absent.
+    def set_next_step(id, text:)
+      record = fetch!(id)
+      briefing = record["briefing"] ||= { "fields" => {}, "next_step" => nil }
+      briefing["next_step"] = Coercion.presence(Coercion.utf8(text.to_s))
+      record["updated_at"] = timestamp
+      @store.set(SCOPE, key_for(id), record)
+      to_session(record)
+    end
+
     # -> bool (delegates to the backend: false for a nonexistent id)
     def delete(id)
       @store.delete(SCOPE, key_for(id))
@@ -126,7 +187,9 @@ module Insika
         vars: record["vars"],
         memory_refs: record["memory_refs"],
         created_at: record["created_at"],
-        updated_at: record["updated_at"]
+        updated_at: record["updated_at"],
+        briefing: record["briefing"] || { "fields" => {}, "next_step" => nil },
+        evidence: record["evidence"]
       )
     end
 

data/lib/insika/settings_store.rb

@@ -13,7 +13,7 @@ module Insika
     SCOPE = "settings"
     KEY   = "general"
 
-    # STRICT config, settings layer (item 23 / §8.1 — "no silent config compat: every
+    # STRICT config, settings layer (— "no silent config compat: every
     # schema migration explicit"). The settings record carries a `schema_version`;
     # every shape change is a numbered migration here, applied ONLY by the explicit
     # `migrate!` (Studio settings saves never silently reinterpret old-shaped data).
@@ -31,7 +31,17 @@ module Insika
       "turn_timeout" => 120,
       "tool_timeout" => 30,
       "compaction" => { "enabled" => false, "keep_last" => 20 },
-      # LLM config v2 (§10). Platform-wide model layer, resolved by the
+      # Data lifecycle (WS8, phase 2): the RETENTION window in days. The
+      # tick's Retention sweep purges sessions (+traces), terminal tasks
+      # (+checkpoints), memory cells and outcomes older than this. nil/0 =
+      # OFF (parity — nothing is ever swept by default).
+      "retention_days" => nil,
+      # memory TTL. Integer = default for every cell; Hash =
+      # per-tenant { "<tenant>" => days, "*" => days } (ops-authored). nil = OFF.
+      # Swept by the Retention tick on its OWN daily claim, NOT gated by
+      # retention_days (D5). Additive key — reads overlay DEFAULTS.
+      "memory_ttl_days" => nil,
+      # LLM config v2. Platform-wide model layer, resolved by the
       # ModelResolver under an agent that pins no model of its own:
       #   default_model/default_provider -> the platform default (Chat > Agent > HERE)
       #   fallback_models -> ordered chain ["provider/model" | "model", ...] tried
@@ -42,13 +52,13 @@ module Insika
       "default_provider" => nil,
       "fallback_models" => [],
       "utility_model" => nil,
-      # Reasoning control (§10, 4-layer: Chat > Agent > Model > Global). `thinking`
+      # Reasoning control (4-layer: Chat > Agent > Model > Global). `thinking`
       # is the GLOBAL default (off/on/low/medium/high; nil = provider default);
       # `model_params` is the PER-MODEL layer, a map "<provider/model>"|"<model>" ->
       # { "thinking" => ... }. Both resolved by the ModelResolver.
       "thinking" => nil,
       "model_params" => {},
-      # Evals (RFC-0008, panel by RFC-0013 §3.9). The GRADERS are platform config, so
+      # Evals (panel by). The GRADERS are platform config, so
       # the operator picks them in the Studio instead of remembering a CLI flag:
       #   judges        -> [{ "model" =>, "provider" => }, …]. [] = deterministic
       #                    asserts only (rubric'd cases read as judge_pending).
@@ -66,7 +76,7 @@ module Insika
         "quorum" => 1,
         "tolerance" => 0.05
       },
-      # Edge limits (item 33 / §12 G7) — the platform layer of the EdgeLimiter.
+      # Edge limits — the platform layer of the EdgeLimiter.
       # nil/0 = off (opt-in). chat_rate_limit = turn attempts per chat per
       # chat_rate_window (s); agent_token_ceiling = total tokens per agent per
       # agent_token_window (s). limit_response overrides the safe reply.