insika 0.1.0 → 0.3.0

data/lib/insika/studio/assets/dist/favicon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="14" fill="#15161b"/>
+  <circle cx="32" cy="32" r="17" fill="#e8b23a" opacity=".18"/>
+  <circle cx="32" cy="32" r="12" fill="#e8b23a"/>
+  <circle cx="32" cy="32" r="4.5" fill="#15161b"/>
+</svg>

data/lib/insika/studio/forms.rb

@@ -1,12 +1,16 @@
 # frozen_string_literal: true
 
 module Studio
-  # Form → command-payload parsing for the Studio App (§11 B6). A mixin, NOT a
+  # Form → command-payload parsing for the Studio App. A mixin, NOT a
   # standalone object: `include`d into App so every method keeps `self` == the
   # App instance and reaches its request helpers (`presence`, `split_list`) and
   # per-request state (`@agent`) exactly as before. Pure extraction — the bodies
   # moved verbatim from app.rb; app_spec's POST cases are the safety net.
   module Forms
+    # The agent config form OWNS every rendered field: a save reflects the
+    # whole form state, so a blank field is a deliberate "clear to default",
+    # never a carry-over. The one exception is keys the form cannot express —
+    # those ride the `carry` merge below (the guardrails corpora precedent).
     def config_patch(r)
       limits = @agent.limits.dup
       # Always present via DEFAULT_LIMITS (tool_concurrency defaults to 1 = serial),
@@ -15,7 +19,7 @@ module Studio
         v = presence(r.params[field])
         limits[field.to_sym] = Integer(v) if v
       end
-      # Per-agent edge overrides (item 33). Unlike the timeouts (always present via
+      # Per-agent edge overrides. Unlike the timeouts (always present via
       # DEFAULT_LIMITS), these are OPT-IN keys: blank DELETES the override (inherit
       # the platform edge settings); 0 explicitly disables for this agent.
       %w[chat_rate_limit agent_token_ceiling].each do |field|
@@ -34,14 +38,260 @@ module Studio
         limits: limits,
         params: params_patch(r),
         model_policy: model_policy_patch(r),
-        guardrails: guardrails_patch(r)
+        guardrails: guardrails_patch(r),
+        # Every remaining AgentProfile field is editable here — the pack
+        # import is one door, this form is the other (hot, no restart).
+        grounding: grounding_patch(r),
+        funnel: funnel_patch(r),
+        followup: followup_patch(r),
+        distill: distill_patch(r),
+        harvest: harvest_patch(r),
+        refinement: refinement_patch(r),
+        budget: budget_patch(r),
+        reliability: reliability_patch(r),
+        routes: json_patch(r, "routes"),
+        outputs: json_patch(r, "outputs"),
+        metadata: json_patch(r, "metadata") || {},
+        alerts: alerts_patch(r),
+        edge_stream: edge_stream_patch(r),
+        stuck_signal: r.params["stuck_signal"] == "1",
+        prompt_caching: r.params["prompt_caching"] == "1",
+        # The one opt-out flag: checked (the rendered default) saves true, an
+        # unchecked box saves an explicit false — both spellings of ON collapse.
+        tool_persistence: r.params["tool_persistence"] == "1",
+        tool_output_compression: r.params["tool_output_compression"] == "1",
+        subagents: list_patch(r, "subagents"),
+        capabilities: list_patch(r, "capabilities"),
+        tools_deferred: list_patch(r, "tools_deferred"),
+        briefing_fields: list_patch(r, "briefing_fields"),
+        context_providers: allowlist_patch(r, "context_providers"),
+        workflows_allow: allowlist_patch(r, "workflows_allow"),
+        approvals_required: list_patch(r, "approvals_required"),
+        policies: list_patch(r, "policies").map(&:to_sym),
+        prompt_refs: list_patch(r, "prompt_refs"),
+        capabilities_declared: list_patch(r, "capabilities_declared"),
+        skills_eager: skills_eager_patch(r)
       }
     end
 
-    # Guardrails config from the form (RFC-0009). The config form OWNS these fields,
-    # so the patch reflects the whole guardrails state. String values round-trip
-    # cleanly through the JSON store; Safety::Config normalizes on read. A blank
-    # moderator drops the key (deterministic only).
+    # grounding — { "mode" => "flag"|"enforce", "matcher" =>
+    # { "sku" => "sku:…", "name_keys" => [...] } }. Blank mode = no grounding
+    # (parity). The matcher keys are carried only while a mode is declared.
+    def grounding_patch(r)
+      mode = presence(r.params["grounding_mode"])
+      return nil unless %w[flag enforce].include?(mode)
+
+      matcher = {}
+      (sku = presence(r.params["grounding_matcher_sku"])) && (matcher["sku"] = sku)
+      keys = list(r.params["grounding_name_keys"])
+      matcher["name_keys"] = keys unless keys.empty?
+      { "mode" => mode, "matcher" => matcher }
+    end
+
+    # the outcome funnel — the pack's own stage vocabulary, edited
+    # hot. Blank stages = no funnel (parity). Stages: one per line.
+    def funnel_patch(r)
+      stages = lines(r.params["funnel_stages"])
+      return nil if stages.empty?
+
+      out = { "stages" => stages }
+      (p = presence(r.params["funnel_primary"])) && (out["primary"] = p)
+      (w = presence(r.params["funnel_attribution_window"])) && (out["attribution_window"] = w)
+      advance = json_block(r.params["funnel_advance_on"], "funnel advance_on")
+      out["advance_on"] = advance unless advance.nil? || advance.empty?
+      out
+    end
+
+    # the follow-up declaration. Blank arm = the feature is off
+    # (parity). The policy keys are all rendered; a blank one drops the key.
+    def followup_patch(r)
+      arm = presence(r.params["followup_arm"])
+      return nil unless arm
+
+      policy = {}
+      tz = presence(r.params["followup_tz"])
+      if tz
+        quiet = { "timezone" => tz }
+        (s = presence(r.params["followup_quiet_start"])) && (quiet["start"] = s)
+        (e = presence(r.params["followup_quiet_end"])) && (quiet["end"] = e)
+        policy["quiet_hours"] = quiet
+      end
+      (f = presence(r.params["followup_max_frequency"])) && (policy["max_frequency"] = f)
+      keywords = list(r.params["followup_cancel_keywords"])
+      policy["cancel_keywords"] = keywords unless keywords.empty?
+      silence = edge_int(r.params["followup_silence_after_sends"], "followup_silence_after_sends")
+      policy["silence_after_sends"] = silence unless silence.nil?
+      { "arm" => arm, "policy" => policy }
+    end
+
+    # distillation — enabled checkbox + the forge's knobs. Blank
+    # prompt/model drop the keys (the engine defaults take over).
+    def distill_patch(r)
+      enabled = r.params["distill_enabled"] == "1"
+      out = { "enabled" => enabled }
+      (p = presence(r.params["distill_prompt"])) && (out["prompt"] = p)
+      (m = presence(r.params["distill_model"])) && (out["model"] = m)
+      %w[idle_hours min_messages max_proposals].each do |key|
+        v = edge_int(r.params["distill_#{key}"], "distill_#{key}")
+        out[key] = v unless v.nil?
+      end
+      out
+    end
+
+    # the gated harvest. Same shape discipline as distill; the
+    # negative list is a JSON array of { rule, pattern, note }.
+    def harvest_patch(r)
+      enabled = r.params["harvest_enabled"] == "1"
+      out = { "enabled" => enabled }
+      (p = presence(r.params["harvest_prompt"])) && (out["prompt"] = p)
+      %w[idle_hours min_messages].each do |key|
+        v = edge_int(r.params["harvest_#{key}"], "harvest_#{key}")
+        out[key] = v unless v.nil?
+      end
+      negative = json_block(r.params["harvest_negative_list"], "harvest negative_list")
+      out["negative_list"] = negative unless negative.nil?
+      miner = harvest_miner_patch(r)
+      out["miner"] = miner unless miner.empty?
+      out
+    end
+
+    def harvest_miner_patch(r)
+      miner = {}
+      (m = presence(r.params["harvest_miner_model"])) && (miner["model"] = m)
+      window = {}
+      (w = edge_int(r.params["harvest_miner_window"], "harvest_miner_window")) && (window["last_sessions"] = w)
+      miner["window"] = window unless window.empty?
+      (m = edge_int(r.params["harvest_miner_max_proposals"], "harvest_miner_max_proposals")) && (miner["max_proposals"] = m)
+      budget = {}
+      (t = edge_int(r.params["harvest_miner_budget_tokens"], "harvest_miner_budget_tokens")) && (budget["tokens"] = t)
+      miner["budget"] = budget unless budget.empty?
+      miner
+    end
+
+    # Refinement: mode select + the report/propose/auto_apply knobs. Blank
+    # mode = report-only (the no-opt-in default — the form's "report" option
+    # writes it down explicitly).
+    def refinement_patch(r)
+      mode = presence(r.params["refinement_mode"])
+      out = { "mode" => mode } if mode
+      (w = edge_int(r.params["refinement_window"], "refinement_window")) && (out["window"] = { "last_sessions" => w })
+      (f = edge_int(r.params["refinement_max_findings"], "refinement_max_findings")) && (out["max_findings"] = f)
+      files = list(r.params["refinement_files"])
+      out["files"] = files unless files.empty?
+      proposers = list(r.params["refinement_proposers"])
+      out["proposers"] = proposers unless proposers.empty?
+      (t = edge_int(r.params["refinement_budget_tokens"], "refinement_budget_tokens")) && (out["budget"] = { "tokens" => t })
+      (e = edge_int(r.params["refinement_auto_apply_max_edits"], "refinement_auto_apply_max_edits")) && (out["auto_apply_max_edits"] = e)
+      out
+    end
+
+    # WS2: the calendar spend caps. All blank = no budget (parity).
+    def budget_patch(r)
+      daily = edge_int(r.params["budget_daily"], "budget_daily")
+      monthly = edge_int(r.params["budget_monthly"], "budget_monthly")
+      return nil if daily.nil? && monthly.nil?
+
+      out = {}
+      out["daily"] = daily unless daily.nil?
+      out["monthly"] = monthly unless monthly.nil?
+      (a = edge_float(r.params["budget_alert_at"], "budget_alert_at")) && (out["alert_at"] = a)
+      out["soft"] = r.params["budget_soft"] == "1"
+      out
+    end
+
+    # WS3: retries/backoff/fallback/breaker/timeout. All blank = the plain
+    # single attempt (parity).
+    def reliability_patch(r)
+      retries = edge_int(r.params["reliability_retries"], "reliability_retries")
+      backoff = presence(r.params["reliability_backoff"])
+      timeout = edge_int(r.params["reliability_timeout"], "reliability_timeout")
+      fallback = list(r.params["reliability_fallback"])
+      return nil if retries.nil? && backoff.nil? && timeout.nil? && fallback.empty?
+
+      out = {}
+      out["retries"] = retries unless retries.nil?
+      out["backoff"] = backoff if backoff
+      out["timeout"] = timeout unless timeout.nil?
+      out["fallback"] = fallback unless fallback.empty?
+      breaker = {}
+      %w[after within cooldown].each do |key|
+        v = edge_int(r.params["reliability_breaker_#{key}"], "reliability_breaker_#{key}")
+        breaker[key] = v unless v.nil?
+      end
+      out["circuit_breaker"] = breaker unless breaker.empty?
+      out
+    end
+
+    # WS6: the operator-alert webhook. Blank = no webhook (parity).
+    def alerts_patch(r)
+      url = presence(r.params["alerts_webhook"])
+      url ? { "webhook" => url } : nil
+    end
+
+    # Which internal channels may cross to the customer. Both checkboxes are
+    # rendered, so the patch reflects the whole state (false = held back).
+    def edge_stream_patch(r)
+      { "thinking" => r.params["edge_thinking"] == "1",
+        "intermediate" => r.params["edge_intermediate"] == "1" }
+    end
+
+    # skills_eager: blank = none (progressive disclosure, parity); "all" =
+    # blanket eager; otherwise a comma list of exactly these.
+    def skills_eager_patch(r)
+      raw = r.params["skills_eager"].to_s.strip
+      return nil if raw.empty?
+
+      raw == "all" ? true : list(raw)
+    end
+
+    # A JSON textarea -> parsed Hash/Array, or nil when blank. Malformed JSON
+    # is a ValidationError (a red flash, never a silent drop).
+    def json_patch(r, field)
+      json_block(r.params[field], field)
+    end
+
+    def json_block(raw, field)
+      text = raw.to_s.strip
+      return nil if text.empty?
+
+      begin
+        JSON.parse(text)
+      rescue JSON::ParserError => e
+        raise Insika::ValidationError, "#{field}: invalid JSON (#{e.message.lines.first.to_s.strip})"
+      end
+    end
+
+    # A comma-separated list field. Blank = [] (none) — the explicit empty
+    # reading; an allowlist-style field wants nil=all and should not use this.
+    def list_patch(r, field)
+      list(r.params[field])
+    end
+
+    # An ALLOWLIST-style field (nil = all, [] = none). Blank → nil (all), the
+    # open reading; a typed list closes it to exactly those names.
+    def allowlist_patch(r, field)
+      names = list(r.params[field])
+      names.empty? ? nil : names
+    end
+
+    def list(str)
+      str.to_s.split(/[,\n]/).map(&:strip).reject(&:empty?).uniq
+    end
+
+    # One non-blank token per line.
+    def lines(str)
+      str.to_s.lines.map(&:strip).reject(&:empty?)
+    end
+
+    # Guardrails config from the form. The config form OWNS the fields it
+    # renders, so the patch reflects the whole rendered state. String values
+    # round-trip cleanly through the JSON store; Safety::Config normalizes on
+    # read. A blank moderator drops the key (deterministic only).
+    #
+    # `corpora` (the removability knob — languages/extra) has NO
+    # form field: it is DSL/pack data (docs/domain.md), not Studio UI. The
+    # form must not erase it on save — carry the existing value through
+    # (the shallow patch merge would otherwise wipe it, the halt_when class).
     def guardrails_patch(r)
       out = {
         "input" => r.params["guardrail_input"] == "1",
@@ -51,10 +301,12 @@ module Studio
       (mod = presence(r.params["guardrail_moderator"])) && (out["moderator"] = mod)
       responses = guardrail_responses_patch(r)
       out["responses"] = responses unless responses.empty?
+      existing = @agent.guardrails || {}
+      out["corpora"] = existing["corpora"] if existing["corpora"]
       out
     end
 
-    # Per-category safe-reply overrides (RFC-0009 §7, config over convention). Only
+    # Per-category safe-reply overrides (config over convention). Only
     # the non-blank fields are persisted; Safety::Config normalizes on read.
     def guardrail_responses_patch(r)
       %w[default injection sexual abuse escalate].each_with_object({}) do |cat, acc|
@@ -62,7 +314,7 @@ module Studio
       end
     end
 
-    # Per-agent generation params (v2, §10). The config form OWNS these fields, so
+    # Per-agent generation params. The config form OWNS these fields, so
     # the patch reflects the whole form state: a blank field drops the key (and an
     # all-blank form clears params to {}). temperature/max_tokens MUST be Numeric —
     # ModelSelection#apply_params guards on `numeric?` and silently skips a String —
@@ -79,7 +331,7 @@ module Studio
       out
     end
 
-    # Per-agent model fence (v2, §10): { "allow" => [refs] } where a ref is
+    # Per-agent model fence: { "allow" => [refs] } where a ref is
     # "provider/model", "provider/*" or "model". Blank textarea -> nil (NO fence,
     # all models — parity). Enforced on the RESOLVED model by the ModelResolver,
     # so a per-chat pin can never escape it.
@@ -101,7 +353,7 @@ module Studio
 
     # Fields a tool CAN carry that this form does not render. The store REPLACES the
     # record on write, so anything missing here is erased — a save that only fixed a
-    # typo in the description would silently drop them (the class of bug §12 already
+    # typo in the description would silently drop them (the class of bug already
     # paid for once). `stored` carries them through untouched.
     UNEDITED_TOOL_FIELDS = %w[group tags halt_when].freeze
 
@@ -166,22 +418,22 @@ module Studio
 
     def settings_patch(r)
       patch = {
-        "streaming" => r.params["streaming"] == "1",
-        "compaction" => {
-          "enabled" => r.params["compaction_enabled"] == "1"
-        }
+        "streaming" => r.params["streaming"] == "1"
       }
       { "request_timeout" => "request_timeout", "max_retries" => "max_retries",
         "turn_timeout" => "turn_timeout", "tool_timeout" => "tool_timeout" }.each_key do |f|
         v = presence(r.params[f])
         patch[f] = Integer(v) if v
       end
-      kl = presence(r.params["keep_last"])
-      patch["compaction"]["keep_last"] = Integer(kl) if kl
+      # memory TTL (days). Blank = off (nil); a number sets the
+      # platform default for EVERY cell. Saving here replaces an ops-authored
+      # per-tenant map in the record — the view says so.
+      v = presence(r.params["memory_ttl_days"])
+      patch["memory_ttl_days"] = v.nil? ? nil : Integer(v)
       patch
     end
 
-    # Edge limits (item 33 / §12 G7) — the platform rate-limit/cost layer, saved
+    # Edge limits — the platform rate-limit/cost layer, saved
     # from its OWN form (a sub-resource, like models). The limit fields write nil
     # when blank (off — the EdgeLimiter reads nil/0 as off); the windows fall back
     # to the built-in defaults when cleared (the limiter guards non-positive).
@@ -209,7 +461,7 @@ module Studio
       { case: parsed }
     end
 
-    # Evals graders (RFC-0013 §3.9). `judges` is one `provider/model` per LINE — a
+    # Evals graders. `judges` is one `provider/model` per LINE — a
     # textarea, because the SIZE of the panel is the point and a fixed pair of fields
     # would cap it at two. A bare `model` (no slash) is valid: the provider is then
     # inferred by RubyLLM, same as everywhere else.
@@ -258,7 +510,7 @@ module Studio
       raise Insika::ValidationError, "#{field} must be an integer (got #{raw.inspect})"
     end
 
-    # LLM config v2 (§10) — the platform model layer, saved from its OWN form (a
+    # LLM config v2 — the platform model layer, saved from its OWN form (a
     # sub-resource, like providers) so the general-settings save never touches it and
     # vice-versa. The scalar refs are always present (blank -> nil, which the
     # deep-merge writes and the ModelResolver reads as "no platform default");
@@ -270,12 +522,12 @@ module Studio
         "default_provider" => presence(r.params["default_provider"]),
         "utility_model" => presence(r.params["utility_model"]),
         "fallback_models" => split_list(r.params["fallback_models"]),
-        # GLOBAL reasoning default (§10, 4-layer). Blank -> nil = provider default.
+        # GLOBAL reasoning default (4-layer). Blank -> nil = provider default.
         "thinking" => presence(r.params["thinking"])
       }
     end
 
-    # Per-model reasoning defaults (§10, the per-model layer). One line per model:
+    # Per-model reasoning defaults (the per-model layer). One line per model:
     #   <provider/model | model> | <off|on|low|medium|high>
     # CSP forbids JS for dynamic rows, so a textarea of lines is the honest path
     # (same idiom as the MCP env / tool params). A blank effort -> {} for that ref

data/lib/insika/studio/nav_icons.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Studio
-  # Nav SVG icons for the Studio App (§11 B6). A mixin included into App: the
+  # Nav SVG icons for the Studio App. A mixin included into App: the
   # `nav_icon` view helper and its icon table, moved verbatim out of app.rb.
   # Inline SVG is CSP-safe (an HTML element, not an external resource).
   module NavIcons
@@ -20,7 +20,12 @@ module Studio
       tasks: '<path d="M11 12H3"/><path d="M16 6H3"/><path d="M16 18H3"/><path d="m18 9 3 3-3 3"/>',
       approvals: '<path d="M9 12l2 2 4-4"/><path d="M12 3a9 9 0 1 0 9 9"/>',
       refinement: '<path d="M21 12a9 9 0 1 1-3-6.7"/><path d="M21 3v5h-5"/><path d="m9 12 2 2 4-4"/>',
-      evals: '<path d="M9 11l3 3L22 4"/><path d="M21 12v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11"/>'
+      evals: '<path d="M9 11l3 3L22 4"/><path d="M21 12v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11"/>',
+      parity: '<path d="M7 21h10"/><path d="M12 3v12"/><path d="m8 11 4 4 4-4"/><path d="M3 17h4l1.5-1.5L6 13 3 15.5z"/><path d="M21 17h-4l-1.5-1.5L18 13l3 2.5z"/>',
+      funnel: '<path d="M3 5h18l-8 9v6l-2 1v-7z"/>',
+      followups: '<path d="M18 8a6 6 0 0 0-12 0c0 7-3 9-3 9h18s-3-2-3-9"/><path d="M13.7 21a2 2 0 0 1-3.4 0"/>',
+      facts: '<path d="M7 3h11a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H7z"/><path d="M7 3v18"/><path d="M11 8h5"/><path d="M11 12h5"/><path d="M11 16h3"/>',
+      harvest: '<path d="M4 20V10"/><path d="M20 20V4"/><path d="M4 10h4v10"/><path d="M20 4h-4v16"/><path d="M4 20h16"/><path d="m8 8 4-4 4 4"/>'
     }.freeze
 
     def nav_icon(key)

data/lib/insika/studio/views/_message.erb

@@ -1,4 +1,4 @@
-<%# Shared transcript bubble/tool-card (§11 A1/A2) — one visual language for the
+<%# Shared transcript bubble/tool-card — one visual language for the
     playground history, the optimistic echo and the read-only session viewer.
     Locals: m = stored message hash {"role","content","at"}; prev = the message before
     it in the thread, or nil (used only to spot a steered message). `content` may be a
@@ -22,7 +22,7 @@
           when it is NOT the natural producer for the role — otherwise every bubble
           would carry a label that says nothing. %>
       <% origin = Insika::MessageOrigin.origin_of(m) unless Insika::MessageOrigin.customer?(m) || Insika::MessageOrigin.agent?(m) %>
-      <%# STEERED (RFC-0015): a customer message sitting right after a tool result arrived
+      <%# STEERED: a customer message sitting right after a tool result arrived
           while the turn was running and was appended at a tool-batch boundary. Derived
           from position, not from a field — a steered message declares no origin, and it
           is right not to: a person typed it. Nothing else in the engine ever puts a user