insika 0.1.0 → 0.3.0

data/lib/insika/studio/app.rb

@@ -30,8 +30,8 @@ module Studio
   # Same-origin assets: versioned esbuild bundle in `assets/dist/*`, served
   # by `/studio/assets/dist/*`. Strict `'self'` CSP (no `unsafe-inline`).
   class App < Roda
-    include Forms     # form -> command-payload parsing (§11 B6)
-    include NavIcons  # nav SVG helper (§11 B6)
+    include Forms     # form -> command-payload parsing
+    include NavIcons  # nav SVG helper
 
     # The session cookie lives N days. 7 days = parity with the OpenClaw default.
     SESSION_MAX_AGE = 7 * 24 * 3600
@@ -81,36 +81,84 @@ module Studio
       def configure(command_bus:, profile_source:, event_stream:, config:,
                     agent_file_store: nil, skill_store: nil, skill_catalog: nil,
                     tool_catalog: nil, tool_store: nil, memory_store: nil, session_store: nil,
+                    memory_audit_store: nil,
                     settings_store: nil, llm_provider_store: nil, mcp_store: nil,
-                    system_file_store: nil, tool_trace_store: nil,
+                    system_file_store: nil, tool_trace_store: nil, context_trace_store: nil,
+                    cache_series_store: nil,
                     task_store: nil, checkpoint_store: nil, pending_action_store: nil,
-                    refinement_store: nil, golden_store: nil, session_secret: nil)
+                    refinement_store: nil, golden_store: nil, session_secret: nil,
+                    outcome_store: nil, shadow_pair_store: nil, parity_criterion: nil,
+                    funnel_store: nil, budget_ledger: nil,
+                    followup_store: nil, contact_store: nil,
+                    proposal_store: nil,
+                    harvest_store: nil, harvest_criterion: nil, negative_list: nil,
+                    channel_registry: nil)
         @insika = {
           command_bus: command_bus, profile_source: profile_source,
           event_stream: event_stream, config: config,
           agent_file_store: agent_file_store, skill_store: skill_store,
           skill_catalog: skill_catalog, tool_catalog: tool_catalog,
-          # tool_store: DATA-DEFINED tool definitions (Phase 5). The catalog already
+          # tool_store: DATA-DEFINED tool definitions. The catalog already
           # shows the data-tools in the matrix; the store feeds the authoring page.
           tool_store: tool_store,
           memory_store: memory_store, session_store: session_store,
+          # the Customers drill renders the audit lines (digests +
+          # counts, never content). nil = the audit section renders empty.
+          memory_audit_store: memory_audit_store,
           # runtime config (settings/LLM/MCP) + global system
           # files + conversations index. All optional (empty-state if nil).
           settings_store: settings_store, llm_provider_store: llm_provider_store,
           mcp_store: mcp_store, system_file_store: system_file_store,
           # per-session tool-call trace (debug): args + result + status per
-          # turn, rendered in the session viewer (FOLLOWUP §3.1).
+          # turn, rendered in the session viewer.
           tool_trace_store: tool_trace_store,
-          # operate: tasks + human-in-the-loop approvals (§12 G5). Reads the
+          # per-session context breakdown: tokens by category +
+          # budget per turn, on the same viewer. Counts only, no content.
+          context_trace_store: context_trace_store,
+          # per-AGENT cache-hit series (percentages + counts, no
+          # content) — the cache tab on the agent detail. nil = tab renders
+          # "No turns recorded.".
+          cache_series_store: cache_series_store,
+          # operate: tasks + human-in-the-loop approvals. Reads the
           # task/checkpoint/pending stores to render; controls (pause/resume/
           # cancel/approve) dispatch on the bus — parity with server/admin.
           task_store: task_store, checkpoint_store: checkpoint_store,
           pending_action_store: pending_action_store,
-          # refinement runs (RFC-0013 phase A): the ranked failure report per agent.
+          # refinement runs: the ranked failure report per agent.
           # Read-only here; the "Run" button dispatches :run_refinement on the bus.
           refinement_store: refinement_store,
-          # eval cases (RFC-0008 §3.1): read to render; writes go through :write_golden.
-          golden_store: golden_store
+          # eval cases: read to render; writes go through:write_golden.
+          golden_store: golden_store,
+          # WS7: business outcomes — the agents grid's last-outcome pill; the
+          # agent detail shows the per-day series. Reads only; recording goes
+          # through POST /v1/outcomes.
+          outcome_store: outcome_store,
+          # the Funnel page reads the fold's cells and the
+          # BudgetLedger's current counters (D6). nil = the page renders its
+          # empty state.
+          funnel_store: funnel_store, budget_ledger: budget_ledger,
+          # the shadow pair store (read to render /studio/parity), the
+          # frozen criterion (folded by Verdict), and the channel registry (the
+          # nav row only exists when a shadow channel is registered — the page
+          # is not an invitation, unlike Refinement's).
+          shadow_pair_store: shadow_pair_store, parity_criterion: parity_criterion,
+          channel_registry: channel_registry,
+          # the Follow-ups page READS the stores directly;
+          # its only mutations — cancel a pending record, force-revoke a contact
+          # — dispatch :cancel_followup / :revoke_contact on the bus. nil = the
+          # page renders its empty state.
+          followup_store: followup_store, contact_store: contact_store,
+          # the Facts (wiki) page reads the proposal store directly
+          # (approvals/rejections dispatch :resolve_proposal on the bus).
+          # nil = the page renders its empty state.
+          proposal_store: proposal_store,
+          # the Harvest page reads the harvest store directly
+          # (the pending/awaiting/promoted lists); its mutations — mine, gate,
+          # promote, reject, rollback — dispatch bus commands. The criterion
+          # (boot-loaded, with its sha) and the negative list render the two
+          # pre-registered artifacts. nil = the page renders its empty state.
+          harvest_store: harvest_store, harvest_criterion: harvest_criterion,
+          negative_list: negative_list
         }.freeze
         # "restart recommended" flag — in memory, PER PROCESS. A
         # config change that the runtime only re-reads at boot (e.g.: MCP instances are
@@ -230,11 +278,15 @@ module Studio
         r.is do
           r.get do
             @agents = insika[:profile_source].all.sort_by(&:id)
+            # WS7 scorecard: the LAST outcome per agent, computed once for the
+            # whole grid (a store scan per card would be n scans). Series live
+            # on the agent detail — one agent's periods, not n charts here.
+            @latest_outcomes = insika[:outcome_store]&.latest_per_agent
             view("agents")
           end
 
           # POST /studio/agents — creates an agent ("everyone creates
-          # their own BIA"). Fires :create_agent; redirects to the new one's detail.
+          # their own agent"). Fires :create_agent; redirects to the new one's detail.
           r.post do
             check_csrf!
             id = presence(r.params["id"])
@@ -266,20 +318,86 @@ module Studio
             with_flash("Configuration saved.") do
               dispatch(:update_agent, config_patch(r))
             end
-            r.redirect(agent_path(id))
+            group = CONFIG_SECTIONS.include?(r.params["cfg"]) ? r.params["cfg"] : "model"
+            r.redirect(agent_path(id, "config", "cfg=#{group}"))
+          end
+
+          # Automatic-loop triggers, per agent. The loops (distillation,
+          # harvest, follow-up firing, funnel fold) already run on their own
+          # worker fibers when the agent declares them; these buttons exist so
+          # an operator can ask for a pass NOW, without waiting for the
+          # window. All three dispatch bus commands — the Studio never runs a
+          # loop itself.
+          r.post "distill" do
+            check_csrf!
+            done = 0
+            skipped = 0
+            begin
+              due_distill_sessions(id).each do |sid|
+                result = dispatch(:run_distillation, { session_id: sid })
+                if result && result[:distilled]
+                  done += 1
+                else
+                  skipped += 1
+                end
+              end
+              flash["notice"] = "Distilled #{done} session(s)" + (skipped.positive? ? " (#{skipped} skipped)." : ".")
+            rescue Insika::ValidationError, Insika::NotFoundError => e
+              flash["error"] = e.message
+            end
+            r.redirect(agent_path(id, "loops"))
+          end
+
+          r.post "harvest" do
+            check_csrf!
+            begin
+              result = dispatch(:run_harvest, { agent: id })
+              if result && result[:mined]
+                flash["notice"] = "Harvest run finished — #{result[:candidates]} candidate(s) mined."
+              elsif result && result[:skipped]
+                flash["notice"] = "Nothing mined — #{result[:skipped]}."
+              else
+                flash["notice"] = "Harvest run finished."
+              end
+            rescue Insika::ValidationError, Insika::NotFoundError => e
+              flash["error"] = e.message
+            end
+            r.redirect(agent_path(id, "loops"))
+          end
+
+          r.post "refinement" do
+            check_csrf!
+            with_flash("Refinement run finished — see the Refinement page.") do
+              dispatch(:run_refinement, { agent: id })
+            end
+            r.redirect(agent_path(id, "loops"))
           end
 
           # Store-backed prompts. Writing also ensures the file
           # enters `prompt_files` — otherwise the Prompt provider wouldn't load it.
           # prompt_files is synced by the Commands themselves (write/delete
           # register/remove the file) — the Studio just dispatches the operation.
+          #
+          # The prompts section renders as a drill (master file list | editor), so
+          # the file under edit rides the URL like skills does: GET .../prompts/:file
+          # opens that file, .../prompts/new opens the create form.
           r.on "prompts" do
+            r.get "new" do
+              @prompt_selected = ""
+              render_agent_detail
+            end
+
+            r.get String do |file|
+              @prompt_selected = utf8(file)
+              render_agent_detail
+            end
+
             r.post "delete" do
               check_csrf!
               with_flash("Prompt removed.") do
                 dispatch(:delete_agent_file, { agent_id: id, file: presence(r.params["file"]) })
               end
-              r.redirect(agent_path(id))
+              r.redirect(agent_path(id, "prompts"))
             end
 
             r.post "restore" do
@@ -290,7 +408,7 @@ module Studio
                            version: r.params["version"]
                          })
               end
-              r.redirect(agent_path(id))
+              r.redirect(prompt_edit_path(id, r.params["file"]))
             end
 
             r.post do
@@ -300,24 +418,62 @@ module Studio
                            agent_id: id, file: presence(r.params["file"]), content: r.params["content"].to_s
                          })
               end
-              r.redirect(agent_path(id))
+              r.redirect(prompt_edit_path(id, r.params["file"]))
             end
           end
 
-          # Agent skills → :update_agent with the `skills` allowlist.
-          # "all" = nil; otherwise the checked subset (possibly []).
-          r.post "skills" do
-            check_csrf!
-            skills = r.params["all_skills"] == "1" ? nil : Array(r.params["skills"]).map(&:to_s)
-            with_flash("Skills updated.") do
-              dispatch(:update_agent, { id: id, skills: skills })
+          r.on "skills" do
+            # POST /studio/agents/:id/skills → :update_agent with the `skills`
+            # allowlist. "all" = nil; otherwise the checked subset (possibly []).
+            r.is do
+              r.post do
+                check_csrf!
+                skills = r.params["all_skills"] == "1" ? nil : Array(r.params["skills"]).map(&:to_s)
+                with_flash("Skills updated.") do
+                  dispatch(:update_agent, { id: id, skills: skills })
+                end
+                r.redirect(agent_path(id))
+              end
+            end
+
+            # /studio/agents/:id/skills/:name — this agent's OWN version of a skill.
+            # TWO path segments, which is exactly why the store takes the agent as a
+            # second argument: a composite "agent/name" key would put a `/` inside
+            # what this route serves as one segment.
+            r.on String do |name|
+              name = utf8(name)
+              r.is do
+                r.get do
+                  load_skills_master(agent: id)
+                  @selected = name
+                  @scope_agent = id
+                  @skill_content = skill_source(name, agent: id)
+                  view("skills")
+                end
+                # Saving the specialization: same command, `agent:` set.
+                r.post do
+                  check_csrf!
+                  with_flash("Specialization saved.") do
+                    dispatch(:write_skill, { name: name, agent: id, content: r.params["content"].to_s })
+                  end
+                  r.redirect("#{agent_path(id)}/skills/#{Rack::Utils.escape(name)}")
+                end
+              end
+
+              # Un-specialize: the shared skill stays, and the agent falls back to it.
+              r.post "delete" do
+                check_csrf!
+                with_flash("Specialization removed — the agent falls back to the shared skill.") do
+                  dispatch(:delete_skill, { name: name, agent: id })
+                end
+                r.redirect("/studio/skills/#{Rack::Utils.escape(name)}")
+              end
             end
-            r.redirect(agent_path(id))
           end
 
           # Agent memory. Scoped by tenant = agent id — the
           # SAME tenant the playground uses when chatting, so what is edited
-          # here is what the BIA reads on the turn. Each agent, its own memory.
+          # here is what the agent reads on the turn. Each agent, its own memory.
           r.on "memory" do
             r.post "fact" do
               check_csrf!
@@ -381,25 +537,37 @@ module Studio
               view("skills")
             end
           end
-          # Enables/disables the skill on N agents at once.
+          # Enables/disables the skill on N agents at once, and marks it always-on for
+          # the ones that checked `eager`. Both are per-agent decisions about the same
+          # skill, so they are the same form and the same dispatch.
           r.post "agents" do
             check_csrf!
             agent_ids = Array(r.params["agent_ids"]).map(&:to_s)
+            eager_ids = Array(r.params["eager_ids"]).map(&:to_s)
             result = with_flash("Skill's agents updated.") do
-              dispatch(:set_skill_agents, { name: name, agent_ids: agent_ids })
-            end
-            skipped = Array(result && result[:skipped_all])
-            if skipped.any?
-              flash["notice"] = "#{flash['notice']} — #{skipped.size} agent(s) with 'all' skills were left intact."
+              dispatch(:set_skill_agents, { name: name, agent_ids: agent_ids, eager_ids: eager_ids })
             end
+            note_skipped(result)
             r.redirect("/studio/skills")
           end
+
+          # Seeds a per-agent override from the SHARED body and opens it for editing.
+          # Seeded and not blank: specializing means "this, but for me" — starting from
+          # an empty editor is how the two versions drift apart on day one.
+          r.post "specialize" do
+            check_csrf!
+            agent_id = presence(r.params["agent_id"])
+            with_flash("Specialized for #{agent_id}.") do
+              dispatch(:write_skill, { name: name, agent: agent_id, content: skill_source(name) })
+            end
+            r.redirect("/studio/agents/#{Rack::Utils.escape(agent_id.to_s)}/skills/#{Rack::Utils.escape(name)}")
+          end
         end
       end
 
       # --- Tools: tool × agent matrix + DATA-DEFINED tool authoring -----------
       r.on "tools" do
-        # Data-defined tool authoring (Phase 5). Under /tools/def/* — BEFORE the
+        # Data-defined tool authoring. Under /tools/def/* — BEFORE the
         # generic `r.post String` matcher (which is the allow/deny matrix per agent :id).
         r.on "def" do
           # /studio/tools/def/new — empty editor.
@@ -474,7 +642,7 @@ module Studio
       r.on "settings" do
         r.is do
           r.get { render_settings }
-          # General settings (streaming/timeouts/compaction) → :update_settings.
+          # General settings (streaming/timeouts) → :update_settings.
           r.post do
             check_csrf!
             with_flash("Settings saved.") do
@@ -484,7 +652,7 @@ module Studio
           end
         end
 
-        # Platform model defaults (sub-resource, v2 §10): its own form/route so a
+        # Platform model defaults (sub-resource, v2): its own form/route so a
         # general-settings save never clobbers the model layer.
         r.post "models" do
           check_csrf!
@@ -494,7 +662,7 @@ module Studio
           r.redirect("/studio/settings?s=models")
         end
 
-        # Per-model reasoning defaults (§10, the per-model layer): its own form so a
+        # Per-model reasoning defaults (the per-model layer): its own form so a
         # model-defaults save never clobbers the per-model map, and vice-versa.
         r.post "model-params" do
           check_csrf!
@@ -504,7 +672,7 @@ module Studio
           r.redirect("/studio/settings?s=models")
         end
 
-        # Edge limits (item 33 / §12 G7): the platform rate-limit/cost layer.
+        # Edge limits: the platform rate-limit/cost layer.
         # Its own form for the same reason as models — saves never cross-clobber.
         r.post "edge" do
           check_csrf!
@@ -514,7 +682,7 @@ module Studio
           r.redirect("/studio/settings?s=edge")
         end
 
-        # Evals (RFC-0008 / RFC-0013 §3.9): the judge PANEL and how it agrees. Its own
+        # Evals: the judge PANEL and how it agrees. Its own
         # form, like models and edge — a save here must not clobber those.
         r.post "evals" do
           check_csrf!
@@ -619,12 +787,93 @@ module Studio
             # Session's tool-call trace (debug): grouped by turn in the view.
             @tool_traces = (insika[:tool_trace_store]&.for_session(sid) || [])
                            .group_by { |t| t["turn"] }
+            # Context breakdown per turn: chronological entries.
+            @context_traces = insika[:context_trace_store]&.for_session(sid) || []
+            # the stage history — the session's outcomes folded
+            # into the agent's declared stages (unmapped kinds render raw).
+            @stage_history = stage_history_for(sid)
             view("session")
           end
         end
       end
 
-      # --- Tasks: list + detail + operator controls (§12 G5) -------
+      # --- Customers: the memory drill  ----------------
+      # Derived from the store, not a registry: the index enumerates memory
+      # cells and classifies them by shape (D6). Every mutation dispatches a
+      # Command on the bus — the transport's constitutional rule (app.rb:21).
+      # The cell scope in the URL is parsed back into the (tenant, customer)
+      # pair: a "memory:acme:c-1" URL must edit the SAME cell the turn reads
+      # (E1 live) — passing the raw scope as `tenant` would double-prefix it.
+      r.on "customers" do
+        r.is do
+          r.get { render_customers }
+        end
+
+        r.on String do |raw_scope|
+          # Roda captures the segment URL-encoded; a customer cell contains
+          # colons (memory:acme:c-1), so decode before parsing.
+          scope = Rack::Utils.unescape_path(utf8(raw_scope))
+          cell = Insika::MemoryStore.parse_cell(scope)
+
+          r.get { render_customer(scope, cell) }
+
+          # Add/edit a fact inline (upsert) — the operator's stamp + audit.
+          r.post "fact" do
+            check_csrf!
+            with_flash("Fact saved.") do
+              dispatch(:memory_put_fact, {
+                         tenant: cell[:tenant], customer: cell[:customer],
+                         key: presence(r.params["key"]), value: r.params["value"].to_s,
+                         expires_at: presence(r.params["expires_at"]), operator: "studio"
+                       })
+            end
+            r.redirect(customer_path(scope))
+          end
+
+          r.post "forget-fact" do
+            check_csrf!
+            with_flash("Fact forgotten.") do
+              dispatch(:memory_forget_fact, {
+                         tenant: cell[:tenant], customer: cell[:customer],
+                         key: presence(r.params["key"]), operator: "studio"
+                       })
+            end
+            r.redirect(customer_path(scope))
+          end
+
+          # The LGPD access right: JSON download of the cell's content (D7 —
+          # the RETURN value is the download; the event stays counts-only). A
+          # cell with no customer (a _default cell, reachable by URL) is a
+          # ValidationError -> red flash, never a 500.
+          r.post "export" do
+            check_csrf!
+            result = dispatch(:export_customer_memory, {
+                                tenant: cell[:tenant], customer: cell[:customer],
+                                operator: "studio"
+                              })
+            response["content-type"] = "application/json"
+            response["content-disposition"] =
+              %(attachment; filename="memory-#{Rack::Utils.escape_path(scope.tr(':', '-'))}.json")
+            JSON.pretty_generate(result)
+          rescue Insika::ValidationError => e
+            flash["error"] = e.message
+            r.redirect(customer_path(scope))
+          end
+
+          # The LGPD forget — purges the cell AND the customer's sessions.
+          r.post "forget" do
+            check_csrf!
+            with_flash("Customer forgotten.") do
+              dispatch(:forget_customer, {
+                         tenant: cell[:tenant], customer: cell[:customer], operator: "studio"
+                       })
+            end
+            r.redirect("/studio/customers")
+          end
+        end
+      end
+
+      # Tasks: list + detail + operator controls -------
       # Parity with server/admin: READS the task/checkpoint/pending stores to
       # render; pause/resume/cancel dispatch Commands on the bus (never a direct
       # store write). Every control audits the ATTEMPT to the EventStream first.
@@ -658,7 +907,7 @@ module Studio
         end
       end
 
-      # --- Approvals: human-in-the-loop inbox (§12 G5) -------------
+      # Approvals: human-in-the-loop inbox -------------
       # Lists every :pending action across tasks; resolving one dispatches
       # :approve_action, which resolves the store AND wakes the suspended turn.
       r.on "approvals" do
@@ -677,7 +926,7 @@ module Studio
         end
       end
 
-# --- Evals: the cases that grade an agent (RFC-0008 §3.1) -------
+# Evals: the cases that grade an agent -------
 # A case is DATA in the same YAML shape the corpus files use, so what an operator
 # edits here is what a pull request would review. The one loader validates it, on
 # the way in — a malformed case is a red flash, never a silently skipped test.
@@ -702,8 +951,8 @@ r.on "evals" do
 end
 
       # --- Refinement: what broke in real traffic, and what to do about it --
-      # `POST /refinement` runs the report (RFC-0013 phase A). `POST
-      # /refinement/propose` is phase C: the configured model writes a candidate from
+      # `POST /refinement` runs the report. `POST
+      # refinement/propose` is: the configured model writes a candidate from
       # the findings and the gate scores it by replaying the golden set. `POST
       # /refinement/resolve` is a human approving or rejecting what the gate passed.
       # All three go through the bus like every other Studio write — this page reads
@@ -748,6 +997,156 @@ end
         end
       end
 
+      # --- Harvest: the gated skill loop  ----------------------
+      # Reads the HarvestStore directly (the Studio's constitutional split);
+      # every mutation — mine now, gate, promote, reject, rollback — dispatches
+      # a bus command. The gate POST is slow on purpose: it replays the golden
+      # set, like Refinement's propose button.
+      r.on "harvest" do
+        r.is do
+          r.get { render_harvest }
+          r.post do # mine now (manual trigger, D10)
+            check_csrf!
+            agent = presence(r.params["agent"])
+            payload = { agent: agent, full: r.params["full"] == "1" }
+            control_action(:run_harvest, payload, ok: "Harvest run finished.")
+            r.redirect("/studio/harvest?agent=#{Rack::Utils.escape(agent.to_s)}")
+          end
+        end
+
+        r.post "gate" do # the double gate on one candidate (slow — replay)
+          check_csrf!
+          agent = presence(r.params["agent"])
+          payload = { candidate_id: presence(r.params["candidate_id"]) }
+          control_action(:gate_harvest, payload, ok: "Gated — see the verdicts below.")
+          r.redirect("/studio/harvest?agent=#{Rack::Utils.escape(agent.to_s)}")
+        end
+
+        r.post "promote" do
+          check_csrf!
+          agent = presence(r.params["agent"])
+          payload = { candidate_id: presence(r.params["candidate_id"]),
+                      operator: "studio", note: presence(r.params["note"]) }.compact
+          control_action(:promote_harvest, payload,
+                         ok: "Promoted — the skill is live for this store.")
+          r.redirect("/studio/harvest?agent=#{Rack::Utils.escape(agent.to_s)}")
+        end
+
+        r.post "reject" do
+          check_csrf!
+          agent = presence(r.params["agent"])
+          payload = { candidate_id: presence(r.params["candidate_id"]),
+                      operator: "studio", note: presence(r.params["note"]) }.compact
+          control_action(:reject_harvest, payload, ok: "Skill rejected.")
+          r.redirect("/studio/harvest?agent=#{Rack::Utils.escape(agent.to_s)}")
+        end
+
+        r.post "rollback" do
+          check_csrf!
+          agent = presence(r.params["agent"])
+          payload = { snapshot_ref: presence(r.params["snapshot_ref"]),
+                      operator: "studio", reason: presence(r.params["reason"]) }.compact
+          control_action(:rollback_harvest, payload, ok: "Rolled back to the snapshot.")
+          r.redirect("/studio/harvest?agent=#{Rack::Utils.escape(agent.to_s)}")
+        end
+      end
+
+      # --- Facts: the human gate on distilled proposals  --------
+      # Reads ProposalStore directly (the Studio's constitutional split — reads
+      # hit the stores, mutations go through the bus); the ONLY mutation — the
+      # approve/reject/dismiss answer — dispatches :resolve_proposal.
+      r.on "facts" do
+        r.get { render_facts }
+        r.post "resolve" do
+          check_csrf!
+          decision = presence(r.params["decision"])
+          ok = { "approved" => "Fact saved to memory.", "rejected" => "Proposal rejected.",
+                 "dismissed" => "Proposal dismissed — it will not be proposed again." }[decision]
+          with_flash(ok || "Proposal resolved.") do
+            dispatch(:resolve_proposal, { proposal_id: presence(r.params["proposal_id"]),
+                                          decision: decision, note: presence(r.params["note"]),
+                                          operator: "studio" })
+          end
+          filter = presence(r.params["filter"])
+          r.redirect("/studio/facts#{filter ? "?store=#{Rack::Utils.escape(filter)}" : ""}")
+        end
+      end
+
+      # --- Parity: the running shadow verdict  -----------------
+      # Reads stores and folds the verdict on demand; the judge button is a slow
+      # synchronous POST, exactly like Refinement's gate, for the same reason: it
+      # returns when the answer is real. There is deliberately no "freeze the
+      # criterion" button — freezing is a git commit, reviewed by a human.
+      r.on "parity" do
+        r.is do
+          r.get { render_parity }
+          r.post do
+            check_csrf!
+            agent = presence(r.params["agent"])
+            limit = presence(r.params["limit"]).to_i
+            payload = { agent: agent }.compact
+            payload[:limit] = limit if limit.positive?
+            control_action(:judge_shadow_pairs, payload,
+                           ok: "Judged — the verdict below is recomputed.")
+            r.redirect("/studio/parity?agent=#{Rack::Utils.escape(agent.to_s)}")
+          end
+        end
+      end
+
+      # --- Funnel: the outcome funnel per store  ----------------
+      # Reads the fold's cells + the BudgetLedger's current counters directly
+      # (D7 — the scorecard's constitutional split); the ONE mutation — the
+      # baseline freeze — dispatches :freeze_funnel_baseline on the bus.
+      r.on "funnel" do
+        r.get { render_funnel }
+        r.on String do |agent_id|
+          agent_id = utf8(agent_id)
+          r.post "freeze" do
+            check_csrf!
+            with_flash("Baseline frozen.") do
+              dispatch(:freeze_funnel_baseline,
+                       { agent: agent_id,
+                         from: presence(r.params["from"]),
+                         to: presence(r.params["to"]),
+                         # the card's hidden tenant field: WITHOUT it, a
+                         # multi-tenant deployment freezes the "platform" pair
+                         # while the operator believes they froze the store's.
+                         tenant: presence(r.params["tenant"]),
+                         operator: "studio" })
+            end
+            r.redirect("/studio/funnel")
+          end
+        end
+      end
+
+      # --- Follow-ups: the schedule records + the A/B readout  --
+      # Reads FollowupStore/ContactStore/OutcomeStore directly (D10 — the
+      # Studio's constitutional split); the ONLY mutations — cancel a pending
+      # record, force-revoke a contact (an opt-out event that never arrived) —
+      # dispatch bus commands.
+      r.on "followups" do
+        r.get { render_followups }
+        r.on String do |agent_id|
+          agent_id = utf8(agent_id)
+          r.post "cancel" do
+            check_csrf!
+            with_flash("Follow-up cancelled.") do
+              dispatch(:cancel_followup, { followup_id: r.params["id"] })
+            end
+            r.redirect("/studio/followups?agent=#{Rack::Utils.escape(agent_id)}")
+          end
+          r.post "revoke" do
+            check_csrf!
+            with_flash("Contact revoked — every pending follow-up cancelled.") do
+              dispatch(:revoke_contact,
+                       { customer: r.params["customer"], operator: "studio" },
+                       tenant: presence(r.params["tenant"]))
+            end
+            r.redirect("/studio/followups?agent=#{Rack::Utils.escape(agent_id)}")
+          end
+        end
+      end
+
       # Playground: sends `send_message` (the SAME Command as the API) and streams the
       # response live through the `live-transcript` island (SSE from /studio/events).
       r.on "playground" do
@@ -755,7 +1154,15 @@ end
           @agent = presence(r.params["agent"]) || default_agent
           @session_id = presence(r.params["session_id"])
           @agents = insika[:profile_source].ids.sort
-          # Server-side echo + continuity (§11 A1): render the session's persisted
+          # Session combobox: recent conversations as <datalist> suggestions for the
+          # session field. The open session always appears, even if it fell off the
+          # recent list (it is the one being edited).
+          @recent = recent_sessions(limit: 8)
+          if @session_id && @recent.none? { |s| s.id == @session_id }
+            current = insika[:session_store]&.find(@session_id)
+            @recent.unshift(current) if current
+          end
+          # Server-side echo + continuity: render the session's persisted
           # transcript as bubbles. The user's message is only persisted at the END
           # of the turn, so the just-sent message rides a one-shot flash bubble
           # (@sent_message) until it lands in history — an optimistic JS echo can't
@@ -772,7 +1179,7 @@ end
           # Blank session = new conversation: created via Command (create_session
           # generates the id — the Studio doesn't write to the store directly). A typed id
           # continues an existing conversation (send_message requires it to exist).
-          # The per-chat model pin (v2, §10) is set at creation and rides the whole
+          # The per-chat model pin is set at creation and rides the whole
           # conversation, so it only applies to a NEW session — an existing one keeps
           # whatever it was pinned to.
           session_id = typed_session ||
@@ -780,7 +1187,7 @@ end
                                       provider: presence(r.params["provider"]),
                                       thinking: presence(r.params["thinking"]))
           dispatch_send_message(agent: agent, session_id: session_id, message: message)
-          # Optimistic echo of the just-sent message (§11 A1): survives the redirect
+          # Optimistic echo of the just-sent message: survives the redirect
           # as a one-shot flash, rendered as a user bubble on the next GET.
           flash["sent_message"] = message unless message.empty?
           r.redirect(playground_path(agent, session_id))
@@ -821,16 +1228,28 @@ end
         ]],
         ["operate", [
           ["Chats", "/studio/chats", :chats],
+          ["Customers", "/studio/customers", :chats],
           ["Playground", "/studio/playground", :playground],
+          ["Funnel", "/studio/funnel", :funnel],
+          # the Follow-ups page — scheduled, fired, blocked and
+          # cancelled records per agent + the per-arm A/B readout card.
+          ["Follow-ups", "/studio/followups", :followups],
+          # the Facts (wiki) page — the human gate on distilled
+          # proposals (approve/reject/dismiss, the latch, the CAS re-present).
+          ["Facts", "/studio/facts", :facts],
+          # the Harvest page — the human gate on mined skills
+          # (gate, promote, reject, rollback; the append-only promotion log).
+          ["Harvest", "/studio/harvest", :harvest],
           ["Tasks", "/studio/tasks", :tasks],
           ["Approvals", "/studio/approvals", :approvals],
           ["Refinement", "/studio/refinement", :refinement],
           ["Evals", "/studio/evals", :evals]
-        ]]
+        ] + parity_nav_item
+        ]
       ]
     end
 
-    # NAV_ICONS + nav_icon moved to Studio::NavIcons (§11 B6).
+    # NAV_ICONS + nav_icon moved to Studio::NavIcons.
 
     def authenticated? = session["auth"] == true
 
@@ -907,14 +1326,14 @@ end
 
     def default_agent
       ids = insika[:profile_source].ids
-      ids.include?("bia") ? "bia" : (ids.first || "bia")
+      ids.include?("demo") ? "demo" : (ids.first || "demo")
     end
 
     # --- Transcript display helpers (playground + session viewer) ------------
 
     # A stored message's content for display: strings as-is; structured payloads
     # as pretty JSON. NEVER Ruby #inspect (session.erb:45 leaked hashrockets to the
-    # operator). §11 A2.
+    # operator)..
     def message_content(content)
       return content.to_s if content.is_a?(String)
 
@@ -923,6 +1342,29 @@ end
       content.to_s
     end
 
+    # An activation label from the context trace, as the operator reads it:
+    # "gift-concierge · trigger:presente". The REASON is the point of the card — a
+    # bare list of names answers "was something injected", never "which one did I
+    # trigger". A label with no reason (a plugin-supplied body) shows just the name.
+    def skill_label(label)
+      return label.to_s unless label.is_a?(Hash)
+
+      name = label["name"].to_s
+      reason = label["reason"].to_s
+      reason.empty? ? name : "#{name} · #{reason}"
+    end
+
+    # One word for the whole turn, for the collapsed summary: the shared reason when
+    # every body arrived the same way, "mixed" when they did not. A turn CAN mix (the
+    # agent's eager set plus what this message triggered), which is exactly why the
+    # single per-turn `mode` this replaced was a lie waiting to happen.
+    def skill_mode(labels)
+      kinds = Array(labels).map { |l| (l.is_a?(Hash) ? l["reason"].to_s : "").split(":").first }.uniq
+      return "context" if kinds.empty? || kinds.any?(&:nil?) || kinds.include?("")
+
+      kinds.length == 1 ? kinds.first : "mixed"
+    end
+
     # ISO8601 → "HH:MM" for a transcript timestamp; "" when unparseable/absent.
     def short_time(iso)
       Time.parse(iso.to_s).strftime("%H:%M")
@@ -971,6 +1413,7 @@ end
 
     def render_agent_detail
       id = @agent.id
+      @config_group = CONFIG_SECTIONS.include?(request.params["cfg"]) ? request.params["cfg"] : "model"
       store = insika[:agent_file_store]
       @prompt_files = Array(@agent.prompt_files).map do |name|
         {
@@ -981,16 +1424,24 @@ end
       end
       @all_skills = insika[:skill_catalog]&.all || []
       @agent_skills = @agent.skills.nil? ? nil : Array(@agent.skills).map(&:to_s)
-      # v2 (§10) config surfaces: generation params + model fence. AgentProfile.build
+      # v2 config surfaces: generation params + model fence. AgentProfile.build
       # string-keys these hashes, so the form helpers read plain string keys.
       @params = @agent.params
       @model_policy_allow = model_policy_allow(@agent)
-      # guardrails config (RFC-0009); nil when the agent never configured any.
+      # guardrails config; nil when the agent never configured any.
       @guardrails = @agent.guardrails || {}
       mem = insika[:memory_store]
       @facts = mem ? mem.facts(tenant: id) : []
       @notes = mem ? mem.notes(tenant: id, limit: 20) : []
       @recent_sessions = recent_sessions
+      # WS7: last outcome + per-day series for THIS agent. The grid already
+      # shows the last-outcome pill; the series is the period view.
+      outcomes = insika[:outcome_store]
+      @latest_outcome = outcomes&.latest_per_agent&.[](id)
+      @outcome_series = outcomes ? outcomes.series(agent: id) : {}
+      # the per-agent cache-hit series (nil store -> the view's
+      # empty state; same guard as the tool trace).
+      @cache_series = insika[:cache_series_store]&.for_agent(id) || []
       view("agent_detail")
     end
 
@@ -1002,8 +1453,95 @@ end
       params[key.to_s].nil? ? "" : params[key.to_s]
     end
 
+    # A free-form config block (string-keyed by AgentProfile.build) rendered
+    # as the JSON textarea the form parses back. Pretty-printed so an operator
+    # actually reads the current state; "" when the block is absent.
+    def agent_json(config)
+      return "" if config.nil? || config.empty?
+
+      JSON.pretty_generate(config)
+    rescue StandardError
+      config.to_s
+    end
+
+    # A list field as comma-joined text for the form's textarea.
+    def agent_list(list)
+      Array(list).join(", ")
+    end
+
+    # A list field as newline-joined lines for the form's textarea.
+    def agent_lines(list)
+      Array(list).join("\n")
+    end
+
+    # The shared "filter by agent" GET form used by every shared screen
+    # (home, chats, tasks, approvals, customers, evals, funnel, follow-ups,
+    # facts, parity). Same markup everywhere: a select that submits on change.
+    def agent_filter_form(path, current)
+      ids = insika[:profile_source].ids.sort
+      options = [["", "all"]] + ids.map { |id| [id, id] }
+      rows = options.map do |value, label|
+        %(<option value="#{value}"#{' selected' if value.to_s == current.to_s}>#{label}</option>)
+      end.join
+      %(<form method="get" action="#{path}" class="actions inline"><label>Agent <select name="agent" onchange="this.form.submit()">#{rows}</select></label></form>)
+    end
+
+    # The sessions of one agent — the session stamps its agent in
+    # `vars["agent"]`, so any list of sessions is filterable by agent.
+    def agent_sessions(sessions, agent)
+      return sessions if agent.nil? || agent.empty?
+
+      sessions.select { |s| session_agent(s) == agent }
+    end
+
+    def session_agent(session)
+      vars = session.respond_to?(:vars) ? session.vars : nil
+      vars.is_a?(Hash) ? vars["agent"].to_s : ""
+    end
+
+    # The distill button's scope (the DistillEngine's own scan, scoped to ONE
+    # agent): the agent's sessions that are idle past the pack's window, long
+    # enough, and not yet distilled. Oldest first, capped — each entry is a
+    # provider call, so one click stays bounded. Reads hit the stores; the
+    # writes go through :run_distillation on the bus.
+    def due_distill_sessions(agent_id, limit: 5)
+      store = insika[:session_store]
+      proposals = insika[:proposal_store]
+      profile = insika[:profile_source].fetch(agent_id)
+      return [] if profile.nil? || store.nil? || proposals.nil?
+
+      config = Insika::Coercion.deep_stringify(profile.distill) || {}
+      idle_hours = positive_int(config["idle_hours"]) || 6
+      min_messages = positive_int(config["min_messages"]) || 3
+      cutoff = Time.now.utc - idle_hours * 3600
+      store.each_id.filter_map do |sid|
+        session = store.find(sid)
+        next unless session
+        next unless session.vars.is_a?(Hash) && session.vars["agent"] == agent_id
+        next if Insika::Coercion.blank?(session.vars["customer"])
+        next unless aged?(session.updated_at, cutoff)
+        next if session.messages.size < min_messages
+        next if proposals.distilled?(sid)
+
+        [sid, session.updated_at.to_s]
+      end.sort_by(&:last).map(&:first).first(limit)
+    end
+
+    def positive_int(value)
+      v = value.to_i
+      v.positive? ? v : nil
+    end
+
+    def aged?(updated_at, cutoff)
+      return false if Insika::Coercion.blank?(updated_at)
+
+      Time.iso8601(updated_at.to_s) <= cutoff
+    rescue ArgumentError
+      false
+    end
+
     # Renders the reasoning <select> shared by the agent config, settings and
-    # playground (§10, 4-layer). `blank_label` names the empty option — the
+    # playground (4-layer). `blank_label` names the empty option — the
     # "inherit the broader layer" / provider-default choice. Values come from a
     # fixed constant (safe to emit); `current` is only compared, never output.
     def thinking_select(name, current, blank_label)
@@ -1047,21 +1585,34 @@ end
 
     # Config patch from the form (native types: memory bool, limits int).
     # Preserves the existing limits, overwriting only the form's fields.
-    # `model` is OPTIONAL as of v2 (§10): blank clears it, so the agent inherits
+    # `model` is OPTIONAL as of v2: blank clears it, so the agent inherits
     # the platform `default_model` via the ModelResolver — the config form is the
     # place that surfaces that layering. params/model_policy: see the helpers below.
     # config_patch/guardrails_patch/guardrail_responses_patch/params_patch/
-    # model_policy_patch/coerce moved to Studio::Forms (§11 B6).
+    # model_policy_patch/coerce moved to Studio::Forms.
 
     # --- Skills index --------------------------------------------------------
 
     # Master data for the Skills drill-down (list + authored badges + agents),
     # shared by every skill route so the master pane always renders. @selected
     # drives the detail pane (nil = none, "" = new, name = edit).
-    def load_skills_master
-      @skills = (insika[:skill_catalog]&.all || []).sort_by(&:name)
-      @stored = insika[:skill_store] ? insika[:skill_store].names : []
+    # `agent` renders the AGENT's view of the catalog: its own version of each shared
+    # skill, plus whatever is private to it. Absent = the shared catalog.
+    def load_skills_master(agent: nil)
+      catalog = insika[:skill_catalog]
+      @skills = (catalog ? catalog.all(agent: agent) : []).sort_by(&:name)
+      @stored = insika[:skill_store] ? insika[:skill_store].names(agent: agent) : []
       @agents = insika[:profile_source].all.sort_by(&:id)
+      # Which agents specialized THIS skill — the availability grid shows it, so an
+      # override is discoverable from the shared skill it overrides.
+      @specialized = insika[:skill_store] ? specialized_by : {}
+    end
+
+    # { skill name => [agent ids] } across every agent scope in the store.
+    def specialized_by
+      insika[:skill_store].agents.each_with_object({}) do |agent, acc|
+        insika[:skill_store].names(agent: agent).each { |name| (acc[name] ||= []) << agent }
+      end
     end
 
     def render_skills_index
@@ -1076,14 +1627,20 @@ end
     # Raw content for the editor: prefer the store (real SKILL.md), otherwise
     # reconstruct from what the catalog parsed (editing a disk skill
     # creates an override in the store — Store wins).
-    def skill_source(name)
-      raw = insika[:skill_store]&.get(name)
+    def skill_source(name, agent: nil)
+      raw = insika[:skill_store]&.get(name, agent: agent)
       return raw if raw
 
-      skill = insika[:skill_catalog]&.find(name)
+      skill = insika[:skill_catalog]&.find(name, agent: agent)
       return new_skill_template(name) unless skill
 
-      "---\nname: #{skill.name}\ndescription: #{skill.description}\n---\n\n#{skill.body}\n"
+      # The WHOLE frontmatter, not just name/description: this text seeds the
+      # specialize action and any first edit of a disk skill, and an override that
+      # silently drops `triggers:` turns the agent's deterministic activation off.
+      fm = ["name: #{skill.name}", "description: #{skill.description}"]
+      fm << "triggers: #{skill.triggers.join(', ')}" if Array(skill.triggers).any?
+      fm << "companions: #{skill.companions.join(', ')}" if Array(skill.companions).any?
+      "---\n#{fm.join("\n")}\n---\n\n#{skill.body}\n"
     end
 
     def new_skill_template(name = "my-skill")
@@ -1097,6 +1654,31 @@ end
       profile.skills.nil? || Array(profile.skills).map(&:to_s).include?(skill_name.to_s)
     end
 
+    # Is this skill always-on for this agent? `skills_eager` is nil/false (none), true
+    # (blanket) or a list — NOT allowlist semantics, so nil must read as false here.
+    def skill_eager_for?(profile, skill_name)
+      spec = profile.skills_eager
+      return true if Insika::Coercion.truthy?(spec)
+      return false if spec.nil? || spec == false
+
+      Array(spec).map(&:to_s).include?(skill_name.to_s)
+    end
+
+    # The two "left intact" outcomes of :set_skill_agents: an agent whose allowlist (or
+    # eager set) is "all" cannot have ONE name removed from it without materializing an
+    # explicit list, which would be a destructive surprise. Say so instead of silently
+    # doing nothing.
+    def note_skipped(result)
+      return unless result
+
+      parts = []
+      skipped = Array(result[:skipped_all])
+      eager = Array(result[:skipped_eager_all])
+      parts << "#{skipped.size} agent(s) with 'all' skills were left intact" if skipped.any?
+      parts << "#{eager.size} agent(s) with blanket eager were left intact" if eager.any?
+      flash["notice"] = "#{flash['notice']} — #{parts.join(', ')}." if parts.any?
+    end
+
     # --- Tools matrix --------------------------------------------------------
 
     def render_tools_matrix
@@ -1137,7 +1719,7 @@ end
       tools.count { |t| allow.include?(t.name.to_s) && !tool_denied_for?(profile, t.name) }
     end
 
-    # --- Data-defined tool authoring (Phase 5) -------------------------------
+    # Data-defined tool authoring -------------------------------
 
     def render_tool_edit(name:, tool:)
       @tool_name = name
@@ -1164,7 +1746,7 @@ end
       }
     end
 
-    # tool_patch/parse_parameters moved to Studio::Forms (§11 B6).
+    # tool_patch/parse_parameters moved to Studio::Forms.
 
     # Inverse of parse_parameters: the stored params -> text for the textarea. A schema
     # the flat sugar can express round-trips as pipe lines (the friendly form); anything
@@ -1242,9 +1824,12 @@ end
     # At-a-glance dashboard: counts + activity + recent conversations. All from
     # data the Studio already reads (one scan of the session store); no new
     # metrics pipeline. `active_now` = sessions touched in the last 5 minutes.
+    # `?agent=` narrows every number to one agent (the sessions stamp their
+    # author in `vars["agent"]`).
     def render_home
       ps = insika[:profile_source]
-      sessions = all_sessions
+      @agent = presence(request.params["agent"])
+      sessions = agent_sessions(all_sessions, @agent)
       @counts = {
         "conversations" => sessions.size,
         "messages" => sessions.sum { |s| Array(s.messages).size },
@@ -1324,6 +1909,10 @@ end
 
     # --- Settings + LLM providers ----------------------------------
 
+    # The agent config tab's groups, in sidebar order. The view renders the
+    # same keys; a bogus ?cfg= falls back to the first group.
+    CONFIG_SECTIONS = %w[model guardrails grounding funnel followups distill harvest refinement budget_rel routing advanced].freeze
+
     SETTINGS_SECTIONS = %w[general models edge evals llm].freeze
     def render_settings
       store = insika[:settings_store]
@@ -1333,10 +1922,10 @@ end
       view("settings")
     end
 
-    # Settings patch from the form. streaming/compaction are bool
-    # (checkbox); the timeouts are integers; compaction.keep_last integer. Only what
-    # came in the form enters the patch (the rest and the defaults are preserved in the store).
-    # settings_patch/model_defaults_patch/provider_patch moved to Studio::Forms (§11 B6).
+    # Settings patch from the form. streaming is a bool (checkbox); the timeouts
+    # are integers. Only what came in the form enters the patch (the rest and
+    # the defaults are preserved in the store).
+    # settings_patch/model_defaults_patch/provider_patch moved to Studio::Forms.
 
     # --- MCP -------------------------------------------------------
 
@@ -1345,7 +1934,7 @@ end
       view("mcp")
     end
 
-    # mcp_patch moved to Studio::Forms (§11 B6).
+    # mcp_patch moved to Studio::Forms.
 
     # --- System-files ----------------------------------------------
 
@@ -1361,20 +1950,67 @@ end
     # --- Chats -----------------------------------------------------
 
     def render_chats
-      @sessions = recent_sessions(limit: 100)
+      @agent = presence(request.params["agent"])
+      @sessions = agent_sessions(recent_sessions(limit: 100), @agent)
       view("chats")
     end
 
-    # --- Tasks & Approvals (§12 G5) --------------------------------
+    # --- Customers  ----------------------------------
+
+    # The index: every CUSTOMER memory cell, grouped by tenant. The caller
+    # passes `reserved:` (profile ids + _default) so the agent-memory tab's
+    # cells and the shared cell stay out of the drill (D6 — the store is
+    # policy-free). Fact count per cell via a keys-only list (no payload
+    # reads per conversation on every render).
+    def render_customers
+      mem = insika[:memory_store]
+      agent_ids = insika[:profile_source] ? insika[:profile_source].all.map(&:id) : []
+      @agent = presence(request.params["agent"])
+      @rows = mem ? mem.customer_cells(reserved: Array(agent_ids) + ["_default"]).map do |cell|
+        { cell: cell, count: mem.fact_count(tenant: cell[:tenant], customer: cell[:customer]) }
+      end : []
+      # ?agent= narrows to one tenant — the memory scope is the agent (the
+      # agent-memory tab writes under tenant = agent id).
+      @rows = @rows.select { |row| row[:cell][:tenant] == @agent } if @agent
+      @by_tenant = @rows.group_by { |row| row[:cell][:tenant] }
+      view("customers")
+    end
+
+    # The detail: the parsed cell, its facts (expired excluded by C1), notes
+    # (append-only), and the operator audit (digests + counts, never content).
+    def render_customer(scope, cell)
+      @cell = cell
+      mem = insika[:memory_store]
+      @facts = mem ? mem.facts(tenant: cell[:tenant], customer: cell[:customer]) : []
+      @notes = mem ? mem.notes(tenant: cell[:tenant], customer: cell[:customer], limit: 50) : []
+      @audit = insika[:memory_audit_store]&.for_cell(scope) || []
+      view("customer")
+    end
+
+    def customer_path(scope)
+      # escape_path, not escape: the route decodes with unescape_path, which
+      # does not turn '+' back into a space (escape's form-encoding would).
+      "/studio/customers/#{Rack::Utils.escape_path(scope)}"
+    end
+
+    # Tasks & Approvals --------------------------------
 
     # Task list, most-recently-updated first. Empty-state if no store was injected.
+    # `?agent=` narrows to one agent (the task's command payload stamps it).
     def render_tasks
       store = insika[:task_store]
+      @agent = presence(request.params["agent"])
       @tasks = store ? store.each_id.filter_map { |id| store.find(id) } : []
+      @tasks = @tasks.select { |t| task_agent(t) == @agent } if @agent
       @tasks = @tasks.sort_by { |t| t.updated_at.to_s }.reverse
       view("tasks")
     end
 
+    def task_agent(task)
+      command = task.command
+      command.is_a?(Hash) ? command.dig("payload", "agent").to_s : ""
+    end
+
     # Task detail: @task is set by the route. Adds the open approvals for this task
     # and its latest checkpoint (both degrade to empty when the store is absent).
     def render_task_detail(id)
@@ -1384,15 +2020,20 @@ end
     end
 
     # Approvals inbox: every :pending action across tasks, each paired with its
-    # task (for the status pill + a link into the task detail).
+    # task (for the status pill + a link into the task detail). `?agent=`
+    # narrows to one agent (via the owning task).
     def render_approvals
       pstore = insika[:pending_action_store]
       tstore = insika[:task_store]
+      @agent = presence(request.params["agent"])
       @approvals = pstore ? pstore.all_open.map { |pa| { pending: pa, task: tstore&.find(pa.task_id) } } : []
+      if @agent
+        @approvals = @approvals.select { |a| task_agent(a[:task]) == @agent if a[:task] }
+      end
       view("approvals")
     end
 
-# --- Evals (RFC-0008 §3.1) -------------------------------------
+# Evals -------------------------------------
 
 # The stored cases, grouped by agent, plus the one being edited (?id=). Cases whose
 # stored mapping no longer validates are listed separately: a broken case must be
@@ -1401,6 +2042,8 @@ def render_evals
   store = insika[:golden_store]
   @cases = store ? store.all : []
   @invalid = store ? store.invalid : []
+  @filter = presence(request.params["agent"])
+  @cases = @cases.select { |g| g.agent == @filter } if @filter
   @by_agent = @cases.group_by(&:agent).sort.to_h
   wanted = presence(request.params["id"])
   @case = wanted && @cases.find { |g| g.id == wanted }
@@ -1417,7 +2060,7 @@ def golden_yaml(golden)
   YAML.dump(h.merge("expect" => golden.expect))
 end
 
-    # --- Refinement (RFC-0013 phase A) -----------------------------
+    # Refinement -----------------------------
 
     # The agent's latest failure report + its run history. Empty-state when no store
     # was injected or the agent has never been run — the page is the invitation to
@@ -1434,6 +2077,331 @@ end
       view("refinement")
     end
 
+    # --- Parity  -------------------------------------------------
+
+    # The nav row exists ONLY when a shadow channel is registered — the page is
+    # not an invitation, unlike Refinement's.
+    def parity_nav_item
+      shadow_channel? ? [["Parity", "/studio/parity", :parity]] : []
+    end
+
+    def shadow_channel?
+      registry = insika[:channel_registry]
+      return false unless registry
+
+      Array(registry.names).any? do |name|
+        channel = registry.find(name)
+        channel.respond_to?(:shadow?) && channel.shadow?
+      end
+    end
+
+    def parity_pairs
+      insika[:shadow_pair_store] ? insika[:shadow_pair_store].each.to_a : []
+    end
+
+    def render_parity
+      @criterion = insika[:parity_criterion]
+      @agent = presence(request.params["agent"])
+      # ONE materialization per request: the fold and the pair list share this
+      # array (the store's counts would scan the whole table a second time).
+      pairs = parity_pairs
+      pairs = pairs.select { |p| p.agent.to_s == @agent } if @agent
+      @report = @criterion && Insika::Parity::Verdict.fold(pairs: pairs, criterion: @criterion)
+      @pairs = pairs.sort_by { |p| p.created_at.to_s }.reverse.first(50)
+      @pending = pairs.count { |p| p.status == :complete }
+      if @criterion
+        @judge_cost = @pending * @criterion.rule.min_judge_models * 2
+        @judge_models = ((insika[:settings_store]&.get || {})["evals"] || {})
+      end
+      # Judge agreement : split/unknown from the fold, plus how many
+      # verdicts flipped with presentation order.
+      @agreement = { order_dependent: pairs.count { |p| p.verdict.is_a?(Hash) && p.verdict["order_dependent"] } }
+      view("parity")
+    end
+
+    # --- Funnel  ------------------------------------------------
+
+    # One card per STORE (agent) that declares a funnel, each with a block per
+    # tenant that has folded cells. The only mutation on this page — the
+    # baseline freeze — dispatches :freeze_funnel_baseline (D7).
+    def render_funnel
+      profiles = insika[:profile_source]&.all || []
+      p = request.params["period"].to_i
+      @period = p.positive? ? p : 30
+      @agent = presence(request.params["agent"])
+      profiles = profiles.select { |p| p.id == @agent } if @agent
+      @stores = profiles.filter_map do |p|
+        decl = Insika::FunnelDeclaration.parse(p.funnel)
+        next unless decl
+
+        { profile: p, decl: decl, tenants: tenants_for(p.id) }
+      end
+      view("funnel")
+    end
+
+    # the Follow-ups page. Per agent WITH a parsed policy, one
+    # block: the pending/fired/cancelled/blocked lists (blocked rows carry the
+    # reason pill), the per-arm counts, the read-only policy summary and the
+    # A/B card (D10 — reads stores, mutates through bus commands only).
+    def render_followups
+      profiles = insika[:profile_source]&.all || []
+      @agent = presence(request.params["agent"])
+      profiles = profiles.select { |p| p.id == @agent } if @agent
+      @stores = profiles.filter_map do |p|
+        decl = Insika::FollowupPolicy.parse(p.followup)
+        next unless decl
+
+        {
+          profile: p, policy: decl,
+          tenant: presence(request.params["tenant"]) || "platform",
+          records: followup_records(p.id, decl),
+          ab: followup_ab(p.id, decl)
+        }
+      end
+      @has_followups = !@stores.empty?
+      view("followups")
+    end
+
+    # the Facts (wiki) page — the human gate on distilled
+    # proposals. Reads ProposalStore + SessionStore directly (D7 — evidence is
+    # a link, never a copy: the excerpt is read from the session at request
+    # time); the mutations dispatch :resolve_proposal on the bus.
+    def render_facts
+      store = insika[:proposal_store]
+      @pending = store ? store.pending(limit: 100) : []
+      @stale   = store ? store.stale(limit: 50) : []
+      @recent  = store ? store.resolved(limit: 20) : []
+      # `?agent=` filters by the proposal's AGENT (the origin session's
+      # stamp); `?store=` keeps filtering by the memory-cell scope (the
+      # pre-review behavior). Both narrow the same three lists.
+      @filter = presence(request.params["agent"]) || presence(request.params["store"])
+      if @filter
+        @pending = @pending.select { |p| scope_matches?(p, @filter) }
+        @stale   = @stale.select { |p| scope_matches?(p, @filter) }
+        @recent  = @recent.select { |p| scope_matches?(p, @filter) }
+      end
+      # The select: the filtered agents (profile ids) PLUS every scope a
+      # proposal ever carried, so an agent with proposals and one without can
+      # both be picked.
+      @stores  = (insika[:profile_source].ids.sort +
+                  (@pending + @stale + @recent).map(&:scope)).uniq.sort
+      @sessions = insika[:session_store]
+      view("facts")
+    end
+
+    # A proposal matches the filter as the memory scope it carries, or as the
+    # agent of the session it came from (when the session is still around).
+    def scope_matches?(proposal, filter)
+      return true if proposal.scope == filter
+
+      session = insika[:session_store]&.find(proposal.session_ref)
+      session && session_agent(session) == filter
+    end
+
+    # the Harvest page — the human gate on mined skills. Reads
+    # HarvestStore/SessionStore directly (the evidence excerpt is read from the
+    # session at request time — D7: ids and indexes only are stored); every
+    # mutation dispatches a bus command.
+    def render_harvest
+      @agents = insika[:profile_source].ids.sort
+      @agent = presence(request.params["agent"]) || @agents.first
+      store = insika[:harvest_store]
+      # EVERY list respects the agent filter (the review fix) — the page is a
+      # per-store inbox, not a global one.
+      @candidates = @agent && store ? store.candidates(agent_id: @agent, status: "awaiting_approval") : []
+      @pending_gates = @agent && store ? store.candidates(agent_id: @agent, status: "pending").first(50) : []
+      @blocked = if @agent && store
+                   store.candidates(agent_id: @agent, status: "gated")
+                        .select { |c| !c.eval_gate || !c.conversion_gate || c.conversion_gate["passed"] == false }
+                        .first(50)
+                 else
+                   []
+                 end
+      @recent = @agent && store ? store.candidates(agent_id: @agent, status: "promoted").first(20) : []
+      @runs = @agent && store ? store.runs_for(@agent, limit: 5) : []
+      @promotions = @agent && store ? store.promotions(agent_id: @agent, limit: 50) : []
+      @criterion = insika[:harvest_criterion]
+      @funnel = insika[:funnel_store]
+      @sessions = insika[:session_store]
+      @negative = insika[:negative_list]
+      @filter = presence(request.params["agent"])
+      view("harvest")
+    end
+
+    # The evidence excerpt for a candidate — the origin sessions' messages at
+    # the stored indexes, read at request time (D7: ids and indexes only).
+    #
+    # An index is validated by the miner as "fits at least one origin
+    # session", so it must NOT be rendered against every origin session — the
+    # same index would point at different conversations (the review fix).
+    # Each index renders ONE message, from the first origin session where it
+    # is in range, labeled with that session.
+    def candidate_excerpt(candidate)
+      Array(candidate.evidence_turns).filter_map do |i|
+        session = Array(candidate.origin).filter_map { |sid| @sessions&.find(sid) }
+                                          .find { |s| s.messages && s.messages[i] }
+        next unless session
+
+        [session.id, i, session.messages[i]["content"].to_s]
+      end
+    end
+
+    # The negative list's rejection counts per rule, read from the RUN
+    # records (D4 — the counts the Studio shows are what the engine logged:
+    # the run carries { rule_id => count, "ungrounded" => N, ... }).
+    def negative_rule_counts
+      store = insika[:harvest_store]
+      return {} unless store
+
+      store.runs_for(@agent || "", limit: 200).each_with_object(Hash.new(0)) do |run, acc|
+        Array(run.rejected).each { |rule, n| acc[rule] += n.to_i }
+      end
+    end
+
+    # The excerpt for a proposal's evidence — the transcript messages at the
+    # stored indexes, read at request time (D7: ids and indexes only are
+    # stored). Deep-links to the existing session page.
+    def proposal_excerpt(proposal)
+      session = @sessions&.find(proposal.session_ref)
+      return [] unless session && session.messages
+
+      Array(proposal.evidence).filter_map do |i|
+        session.messages[i] && session.messages[i]["content"].to_s
+      end
+    end
+
+    # The agent's records across every status (a nil store reads as none).
+    def followup_records(agent_id, _decl)
+      store = insika[:followup_store]
+      return [] unless store
+
+      store.for_agent(tenant: presence(request.params["tenant"]) || "platform",
+                      agent: agent_id)
+    end
+
+    # The A/B readout per arm (D3 — a read-only fold over the same records):
+    #   sent         = fired count in the period;
+    #   conversions  = outcome records whose session_id is a fired record's
+    #                  session (primary-filtered by the   declaration
+    #                  when one exists, else the first outcome per session);
+    #   opt-outs     = contact cells flipped :revoked after a fired_at.
+    # The note anchors the ruler outside the card: the A/B is the operator's;
+    # this card reads the   baseline.
+    def followup_ab(agent_id, _decl)
+      store = insika[:followup_store]
+      return {} unless store
+
+      from = (Time.now.utc - 30 * 86_400).iso8601
+      fired = store.for_agent(tenant: presence(request.params["tenant"]) || "platform",
+                              agent: agent_id)
+                .select { |r| r.status == "fired" && r.at.to_s >= from }
+      fired.group_by(&:arm).each_with_object({}) do |(arm, records), acc|
+        sessions = records.filter_map(&:session_id)
+        acc[arm] = { sent: records.size, conversions: conversions_for(agent_id, sessions),
+                     opt_outs: opt_outs_since(records) }
+      end
+    end
+
+    # The conversions of the arm's fired sessions. Primary-filtered by the
+    #   funnel declaration when the agent declares one; else the FIRST
+    # outcome per session (an outcome record is one vote per session).
+    def conversions_for(agent_id, sessions)
+      outcomes = insika[:outcome_store]
+      return 0 unless outcomes
+
+      records = sessions.empty? ? [] : outcomes.all.select { |r| sessions.include?(r.session_id) }
+      primary = primary_stage_for(agent_id)
+      return records.count { |r| r.outcome == primary } if primary
+
+      records.group_by(&:session_id).size
+    end
+
+    def primary_stage_for(agent_id)
+      profile = insika[:profile_source]&.fetch(agent_id)
+      decl = profile && Insika::FunnelDeclaration.parse(profile.funnel)
+      decl && decl.primary
+    end
+
+    # The opt-outs of ONE arm: contact cells of the customers THAT ARM fired
+    # to (same tenant), flipped :revoked after that customer's own fire. Never
+    # a global revoked count — an unrelated opt-out (another tenant, another
+    # customer) must not count against an arm, or the H-followup kill decision
+    # reads strangers.
+    def opt_outs_since(records)
+      store = insika[:contact_store]
+      return 0 unless store
+
+      cells = store.cells
+      # group this arm's fires by (tenant, customer) -> the earliest fire
+      records.group_by { |r| [r.tenant, r.customer] }.sum do |(tenant, customer), recs|
+        fired_at = recs.filter_map { |r| parse_time(r.fired_at || r.at) }.min
+        next 0 if fired_at.nil?
+
+        cell = cells["#{tenant}:#{customer}"]
+        cell && cell["state"] == "revoked" && revoke_after?(cell, fired_at) ? 1 : 0
+      end
+    end
+
+    def revoke_after?(cell, fired_at)
+      updated = parse_time(cell["updated_at"])
+      updated && updated > fired_at
+    end
+
+    def parse_time(value)
+      Time.iso8601(value.to_s)
+    rescue ArgumentError
+      nil
+    end
+
+    # Tenant list per agent, derived from the store cells (D7, the 0031 drill
+    # pattern) — multi-tenant deployments show one card block per tenant; a
+    # single-tenant deployment just "platform".
+    def tenants_for(agent_id)
+      cells = insika[:funnel_store]&.pairs.to_a || []
+      cells.select { |c| c[:agent] == agent_id }.map { |c| c[:tenant] }
+    end
+
+    # Sums the folded counts over the period -> { stage => count } for the view.
+    # A nil store (base wiring) reads as all-zero — the page still renders the
+    # declaration and the freeze form.
+    def funnel_period_counts(store, tenant, agent, period)
+      return {} unless store
+
+      today = Date.today.iso8601
+      from = (Date.today - period).iso8601
+      store.days(tenant: tenant, agent: agent, from: from, to: today)
+           .each_with_object(Hash.new(0)) { |(_, counts), acc| counts.each { |s, n| acc[s] += n } }
+    end
+
+    # BudgetLedger's current counters (D6): "tokens today / this month". nil
+    # store -> the view renders 0 (the empty state).
+    def funnel_spend(store, tenant, agent)
+      return { daily: 0, monthly: 0 } unless store
+
+      store.current(tenant: tenant, agent: agent)
+    end
+
+    # the session's stage history — each outcome record of the
+    # session folded to its stage by the agent's declaration (unmapped kinds
+    # render the raw outcome with a muted note — the hole is visible).
+    # Without a declaration the block renders the raw outcomes.
+    def stage_history_for(sid)
+      records = Array(insika[:outcome_store]&.all&.select { |r| r.session_id == sid })
+                 .sort_by { |r| r.at.to_s }
+      return [] if records.empty?
+
+      agent = records.first.agent
+      profile = insika[:profile_source]&.fetch(agent)
+      decl = profile && Insika::FunnelDeclaration.parse(profile.funnel)
+      {
+        declaration: decl,
+        rows: records.map do |r|
+          stage = decl && decl.advance_on[r.outcome]
+          { outcome: r.outcome, stage: stage, at: r.at, value: r.value }
+        end
+      }
+    end
+
     # A run's window in words. An EMPTY window means "the collector's own default" —
     # resolve it for the operator instead of rendering a blank.
     def refinement_window(window)
@@ -1484,7 +2452,7 @@ end
 
     def task_path(id) = "/studio/tasks/#{Rack::Utils.escape(id.to_s)}"
 
-    # parse_kv_lines moved to Studio::Forms (§11 B6).
+    # parse_kv_lines moved to Studio::Forms.
 
     # CSV/whitespace -> [String], blanks dropped.
     def split_list(str)
@@ -1519,11 +2487,26 @@ end
       "/studio/playground?#{query}"
     end
 
-    def agent_path(id, anchor = nil)
+    def agent_path(id, anchor = nil, query = nil)
       base = "/studio/agents/#{Rack::Utils.escape(id)}"
+      base += "?#{query}" if query
       anchor ? "#{base}##{anchor}" : base
     end
 
+    # Deterministic avatar hue: the id's fingerprint, so agents/sessions are
+    # scannable at a glance (Linear-style). CSP forbids inline styles, so the
+    # hue is a class: avatar-h0..avatar-h9 in application.css.
+    def avatar_class(id)
+      "avatar-h#{id.to_s.bytes.sum % 10}"
+    end
+
+    # Where a prompt POST lands back: the same file open in the drill, scrolled
+    # to the prompts section. No file (a delete, say) → the agent page itself.
+    def prompt_edit_path(id, file)
+      name = presence(file)
+      name ? "#{agent_path(id)}/prompts/#{Rack::Utils.escape(name)}#prompts" : agent_path(id, "prompts")
+    end
+
     # Serves a versioned asset from dist. `File.basename` kills path traversal; only
     # files that exist in the dist dir are served.
     def serve_asset(name)