insika 0.1.0 → 0.3.0

data/lib/insika.rb

@@ -2,6 +2,33 @@
 
 require_relative "insika/version"
 require_relative "insika/errors"
+# the payload selection + the domain-boundary audit yardstick.
+# Pure module — loaded by the gemspec too, so it carries no app requires.
+require_relative "insika/packaging"
+require_relative "insika/provider_error_classifier"
+require_relative "insika/token_store"
+require_relative "insika/budget_ledger"
+require_relative "insika/circuit_state"
+require_relative "insika/reliability"
+require_relative "insika/routing"
+require_relative "insika/media"
+require_relative "insika/alert_dispatcher"
+require_relative "insika/outcome_store"
+require_relative "insika/retention"
+require_relative "insika/funnel_declaration"
+require_relative "insika/funnel_store"
+require_relative "insika/funnel_fold"
+# the parsed follow-up policy of ONE agent — the ONLY shape the
+# engine accepts (tool/engine/doctor/Studio share it). Pure value object.
+require_relative "insika/followup_policy"
+# the contact-state cells and the follow-up schedule records.
+# Both are dumb domain stores over the injected backend.
+require_relative "insika/contact_store"
+require_relative "insika/followup_store"
+# the tick-driven firer — rides the same tick as retention/funnel.
+require_relative "insika/followup_engine"
+require_relative "insika/commands/freeze_funnel_baseline"
+require_relative "insika/channels/webhook"
 require_relative "insika/coercion"
 require_relative "insika/message_origin"
 require_relative "insika/env_schema"
@@ -14,19 +41,27 @@ require_relative "insika/model_selection"
 require_relative "insika/model_resolver"
 require_relative "insika/tool_definition"
 require_relative "insika/tool_manifest"
+# the pack's grounding policy (Insika::Grounding + the
+# GroundingMatcher it wraps). Pure Ruby — profile data, parsed per turn.
+require_relative "insika/grounding"
 require_relative "insika/frontmatter"
 require_relative "insika/token_estimator"
 require_relative "insika/checkpoint"
 require_relative "insika/command"
 require_relative "insika/hooks"
 require_relative "insika/middleware"
-# Production edge (item 33 / §12 G7): windowed counters + the rate-limit/cost
+# Production edge: windowed counters + the rate-limit/cost
 # Middleware. Both inert until configured (nil/0 = off).
 require_relative "insika/usage_ledger"
+require_relative "insika/budget_ledger"
 require_relative "insika/edge_limiter"
-# Content safety / guardrails (RFC-0009). detectors.rb is self-contained (the eval
-# requires it directly, D4); the rest hang off Middleware/hooks seams. No ruby_llm
-# at load-time — Factory requires the gem lazily, like the Executor's create_chat.
+require_relative "insika/tool_output_compressor"
+# Content safety / guardrails. The pattern SOURCE is the
+# language-tagged data in safety/corpus.rb; detectors.rb compiles it. Both are
+# self-contained (the eval requires detectors.rb directly); the rest hang off
+# Middleware/hooks seams. No ruby_llm at load-time — Factory requires the gem
+# lazily, like the Executor's create_chat.
+require_relative "insika/safety/corpus"
 require_relative "insika/safety/detectors"
 require_relative "insika/safety/safe_responses"
 require_relative "insika/safety/config"
@@ -43,9 +78,15 @@ require_relative "insika/context/builder"
 require_relative "insika/context/providers/request"
 require_relative "insika/context/providers/prompt"
 require_relative "insika/context/providers/skill"
+require_relative "insika/context/providers/skill_trigger"
 require_relative "insika/context/providers/tool_search"
 require_relative "insika/context/providers/memory"
 require_relative "insika/context/providers/session"
+require_relative "insika/context/providers/briefing"
+# the cache-prefix hash chain + the per-agent cache-hit series.
+# Both are referenced by the Executor at runtime, so they load before it.
+require_relative "insika/prefix_fingerprint"
+require_relative "insika/cache_series_store"
 require_relative "insika/policy/policy"
 require_relative "insika/policy/engine"
 require_relative "insika/registry"
@@ -65,11 +106,15 @@ require_relative "insika/task_store"
 require_relative "insika/checkpoint_store"
 require_relative "insika/pending_action_store"
 require_relative "insika/delegation_store"
-# Channels (RFC-0011): the outbound record + the inbound retry window. Both are
+# Channels: the outbound record + the inbound retry window. Both are
 # plain stores; the channel objects themselves come after the HTTP client.
 require_relative "insika/outbox_store"
+require_relative "insika/shadow_pair_store"
 require_relative "insika/inbound_log"
 require_relative "insika/memory_store"
+# the operator-mutation audit trail. After memory_store (no
+# mutual deps). Pure stdlib — `load_guard_spec` stays green.
+require_relative "insika/memory_audit_store"
 require_relative "insika/config_store"
 require_relative "insika/profile_source"
 require_relative "insika/agent_file_store"
@@ -77,7 +122,12 @@ require_relative "insika/skill_store"
 require_relative "insika/secret_masking"
 require_relative "insika/tool_store"
 require_relative "insika/tool_trace_store"
-# Refinement (RFC-0013 phase A): the run record + the evidence half of the loop.
+require_relative "insika/context_trace_store"
+# the model-visible payload of one ask + its durable trace —
+# "model-visible means logged" (the conformance suite's reconstruction half).
+require_relative "insika/model_visible"
+require_relative "insika/model_visible_trace_store"
+# Refinement: the run record + the evidence half of the loop.
 # Reads sessions/tasks/traces above; requires Safety::Detectors (loaded earlier) for
 # the PII redaction of the snippets it puts in a report.
 require_relative "insika/refinement_store"
@@ -90,9 +140,12 @@ require_relative "insika/refinement/candidate"
 require_relative "insika/refinement/proposer"
 require_relative "insika/egress_guard"
 require_relative "insika/schema_guard"
+# the evidence contract (Spec + Processor + EvidenceLedger). Pure Ruby.
+# Required BEFORE tool_envelope.rb — the envelope references it at runtime.
+require_relative "insika/evidence"
 require_relative "insika/sandbox"
 require_relative "insika/http_client"
-# Channels (RFC-0011 §4/§6): the registry, the bundled relay adapter and the
+# Channels: the registry, the bundled relay adapter and the
 # out-of-band dispatcher. After http_client and egress_guard — the relay POSTs
 # through both — and after registry.rb, which ChannelRegistry extends.
 require_relative "insika/channel_registry"
@@ -103,11 +156,11 @@ require_relative "insika/overlay_tool_registry"
 require_relative "insika/settings_store"
 require_relative "insika/llm_provider_store"
 require_relative "insika/llm_configurator"
-# LLM-first onboarding surface (item 20 / §5.6): serves start.md + models.json + the
+# LLM-first onboarding surface: serves start.md + models.json + the
 # public docs. Reads the settings/provider stores above at call-time (order is free).
 require_relative "insika/onboarding"
-# Evals (RFC-0008) — the quality harness, moved under lib/ so the engine can call it
-# (the RFC-0013 refinement gate scores a candidate agent with the SAME judge the CLI
+# Evals — the quality harness, moved under lib/ so the engine can call it
+# (the refinement gate scores a candidate agent with the SAME judge the CLI
 # uses; a second copy would be the worst outcome). It stays a CLIENT of the engine:
 # HttpTransport talks to a running deployment, nothing here reads a store. Pure Ruby +
 # stdlib; the judge's provider call is injected, so no ruby_llm at load time.
@@ -119,14 +172,18 @@ require_relative "insika/evals/runner"
 require_relative "insika/evals/report"
 require_relative "insika/evals/baseline"
 require_relative "insika/evals/transport"
-# Authored eval cases (RFC-0013 §3.7): the corpus becomes editable without a
+# shadow parity: the frozen criterion and the mechanical
+# fold over the pair store (C6). Pure — no store, no provider gem.
+require_relative "insika/parity/criterion"
+require_relative "insika/parity/verdict"
+# Authored eval cases: the corpus becomes editable without a
 # checkout. Requires the loader above (it is the one validator).
 require_relative "insika/golden_store"
 require_relative "insika/baseline_store"
-# RFC-0013 §3.5: scores a candidate by REPLAYING it. After evals (the runner and
+# scores a candidate by REPLAYING it. After evals (the runner and
 # the baseline comparison) and after the stores it clones an agent through.
 require_relative "insika/refinement/gate"
-# RFC-0013 §3.9 (phase D): the proposer PANEL and the run's token budget. Needs the
+# the proposer PANEL and the run's token budget. Needs the
 # candidate format and the gate's Report shape, so it loads after both.
 require_relative "insika/refinement/panel"
 require_relative "insika/mcp_store"
@@ -151,6 +208,7 @@ require_relative "insika/commands/write_agent_file"
 require_relative "insika/commands/delete_agent_file"
 require_relative "insika/commands/restore_agent_file"
 require_relative "insika/commands/write_skill"
+require_relative "insika/commands/delete_skill"
 require_relative "insika/commands/set_skill_agents"
 require_relative "insika/commands/memory_put_fact"
 require_relative "insika/commands/memory_forget_fact"
@@ -162,6 +220,45 @@ require_relative "insika/commands/write_golden"
 require_relative "insika/commands/update_settings"
 require_relative "insika/commands/upsert_llm_provider"
 require_relative "insika/commands/delete_llm_provider"
+require_relative "insika/commands/issue_tenant_token"
+require_relative "insika/commands/revoke_token"
+require_relative "insika/commands/rotate_tenant_token"
+require_relative "insika/commands/record_outcome"
+require_relative "insika/commands/record_shadow_reply"
+require_relative "insika/commands/judge_shadow_pairs"
+require_relative "insika/commands/session_purge"
+require_relative "insika/commands/forget_customer"
+require_relative "insika/commands/delete_tenant_data"
+# the LGPD access right — export one customer's memory cell as
+# content (the Studio download); the event stays counts-only.
+require_relative "insika/commands/export_customer_memory"
+# the operator/integration follow-up mutations (cancel one
+# record; revoke a contact + fall its pending records atomically).
+require_relative "insika/commands/cancel_followup"
+require_relative "insika/commands/revoke_contact"
+# session distillation — the distiller (pure, injected ask)
+# and the proposal store (proposals + the latched dedup ledger + the
+# per-session distilled marker).
+require_relative "insika/distill"
+require_relative "insika/proposal_store"
+require_relative "insika/commands/run_distillation"
+require_relative "insika/distill_engine"
+require_relative "insika/commands/resolve_proposal"
+# the gated harvest — the miner (pure, injected ask), the
+# frozen conversion criterion and the versioned negative list. The provider
+# touch stays inside MinerFactory's lazy ask (load_guard stays green).
+require_relative "insika/harvest"
+require_relative "insika/harvest/criterion"
+require_relative "insika/harvest/negative_list"
+require_relative "insika/harvest/conversion_gate"
+require_relative "insika/harvest/gate"
+require_relative "insika/harvest_store"
+require_relative "insika/commands/run_harvest"
+require_relative "insika/commands/gate_harvest"
+require_relative "insika/commands/promote_harvest"
+require_relative "insika/commands/rollback_harvest"
+require_relative "insika/commands/reject_harvest"
+require_relative "insika/harvest_engine"
 require_relative "insika/commands/upsert_mcp"
 require_relative "insika/commands/delete_mcp"
 require_relative "insika/commands/write_system_file"
@@ -179,6 +276,8 @@ require_relative "insika/session_actor"
 require_relative "insika/skill_catalog"
 require_relative "insika/tool_catalog"
 require_relative "insika/steer_injector"
+require_relative "insika/loop_detector"
+require_relative "insika/balloon_splitter"
 require_relative "insika/turn_output"
 require_relative "insika/turn_state"
 require_relative "insika/turn_timing"
@@ -188,19 +287,26 @@ require_relative "insika/tool_assembly"
 require_relative "insika/chat_builder"
 require_relative "insika/executor"
 require_relative "insika/shutdown"
+require_relative "insika/tick"
 require_relative "insika/pack"
 require_relative "insika/pack_importer"
 require_relative "insika/telemetry"
-# Strict config + diagnosis (item 23 / §8.1). Doctor reads the config stores above;
+# Strict config + diagnosis. Doctor reads the config stores above;
 # EnvSchema (required at the top) is its env layer.
 require_relative "insika/doctor"
+# Soak: the 72h uptime-degradation harness. Pure stdlib — the
+# envelope and the report fold are deterministic, the runner only talks Net::HTTP.
+require_relative "insika/soak/envelope"
+require_relative "insika/soak/report"
+require_relative "insika/soak/runner"
+require_relative "insika/vitals"
 # Shared composition core for both roots (config/wiring.rb + config/deployment.rb).
 # Only references the classes above at call-time, so require order is unconstrained.
 require_relative "insika/wiring/graph"
-# Public Ruby DSL (item 36): Insika.agent { … }. The Builder is gem-free (it only
+# Public Ruby DSL: Insika.agent { … }. The Builder is gem-free (it only
 # generates a Pack); the runtime (chat/serve) is required lazily by Definition, so
 # `require "insika"` stays free of ruby_llm and the HTTP server.
 require_relative "insika/dsl"
 # Do NOT require "insika/tools/load_skill" here: it does `require "ruby_llm"` at
 # the top (inherits from RubyLLM::Tool) and would pull the gem in at load-time. The
-# Executor loads it lazily inside create_chat (D9).
+# Executor loads it lazily inside create_chat.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: insika
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Guilherme Lages Santos
@@ -151,6 +151,7 @@ files:
 - README.md
 - bin/insika
 - docs/AGENTS.md
+- docs/API.md
 - docs/ARCHITECTURE.md
 - docs/BENCHMARK.md
 - docs/CHANNELS.md
@@ -158,6 +159,8 @@ files:
 - docs/DEPLOY.md
 - docs/EMBEDDING.md
 - docs/EVALS.md
+- docs/FACTS.md
+- docs/HARVEST.md
 - docs/LOADTEST.md
 - docs/OBSERVABILITY.md
 - docs/PLUGINS.md
@@ -167,10 +170,12 @@ files:
 - docs/SANDBOX.md
 - docs/SECURITY.md
 - docs/SKILLS.md
+- docs/SOAK.md
 - docs/TOOLS.md
 - docs/WHY.md
 - docs/WORKFLOWS.md
 - docs/build.md
+- docs/domain.md
 - docs/index.md
 - docs/onboarding/start.md
 - docs/operate.md
@@ -179,8 +184,12 @@ files:
 - lib/insika.rb
 - lib/insika/agent_file_store.rb
 - lib/insika/agent_profile.rb
+- lib/insika/alert_dispatcher.rb
 - lib/insika/allowlist.rb
+- lib/insika/balloon_splitter.rb
 - lib/insika/baseline_store.rb
+- lib/insika/budget_ledger.rb
+- lib/insika/cache_series_store.rb
 - lib/insika/capability/resolved_tool.rb
 - lib/insika/capability_registry.rb
 - lib/insika/channel_delivery.rb
@@ -188,14 +197,17 @@ files:
 - lib/insika/channels/relay.rb
 - lib/insika/channels/web.rb
 - lib/insika/channels/web/widget.js
+- lib/insika/channels/webhook.rb
 - lib/insika/chat_builder.rb
 - lib/insika/checkpoint.rb
 - lib/insika/checkpoint_store.rb
+- lib/insika/circuit_state.rb
 - lib/insika/coercion.rb
 - lib/insika/command.rb
 - lib/insika/command_bus.rb
 - lib/insika/commands/agent_payload.rb
 - lib/insika/commands/approve_action.rb
+- lib/insika/commands/cancel_followup.rb
 - lib/insika/commands/cancel_task.rb
 - lib/insika/commands/create_agent.rb
 - lib/insika/commands/create_session.rb
@@ -204,21 +216,41 @@ files:
 - lib/insika/commands/delete_data_tool.rb
 - lib/insika/commands/delete_llm_provider.rb
 - lib/insika/commands/delete_mcp.rb
+- lib/insika/commands/delete_skill.rb
 - lib/insika/commands/delete_system_file.rb
+- lib/insika/commands/delete_tenant_data.rb
+- lib/insika/commands/export_customer_memory.rb
+- lib/insika/commands/forget_customer.rb
+- lib/insika/commands/freeze_funnel_baseline.rb
+- lib/insika/commands/gate_harvest.rb
 - lib/insika/commands/gate_refinement.rb
 - lib/insika/commands/import_mcp_tools.rb
 - lib/insika/commands/import_tools.rb
+- lib/insika/commands/issue_tenant_token.rb
+- lib/insika/commands/judge_shadow_pairs.rb
 - lib/insika/commands/memory_add_note.rb
 - lib/insika/commands/memory_forget_fact.rb
 - lib/insika/commands/memory_put_fact.rb
 - lib/insika/commands/pause_task.rb
+- lib/insika/commands/promote_harvest.rb
+- lib/insika/commands/record_outcome.rb
+- lib/insika/commands/record_shadow_reply.rb
+- lib/insika/commands/reject_harvest.rb
+- lib/insika/commands/resolve_proposal.rb
 - lib/insika/commands/resolve_refinement.rb
 - lib/insika/commands/restore_agent_file.rb
 - lib/insika/commands/restore_data_tool.rb
 - lib/insika/commands/restore_system_file.rb
 - lib/insika/commands/resume_task.rb
+- lib/insika/commands/revoke_contact.rb
+- lib/insika/commands/revoke_token.rb
+- lib/insika/commands/rollback_harvest.rb
+- lib/insika/commands/rotate_tenant_token.rb
+- lib/insika/commands/run_distillation.rb
+- lib/insika/commands/run_harvest.rb
 - lib/insika/commands/run_refinement.rb
 - lib/insika/commands/send_message.rb
+- lib/insika/commands/session_purge.rb
 - lib/insika/commands/set_agent_tools.rb
 - lib/insika/commands/set_skill_agents.rb
 - lib/insika/commands/trigger_workflow.rb
@@ -232,18 +264,24 @@ files:
 - lib/insika/commands/write_skill.rb
 - lib/insika/commands/write_system_file.rb
 - lib/insika/config_store.rb
+- lib/insika/contact_store.rb
 - lib/insika/context/builder.rb
 - lib/insika/context/catalog_provider.rb
 - lib/insika/context/fragment.rb
 - lib/insika/context/priority.rb
 - lib/insika/context/provider.rb
+- lib/insika/context/providers/briefing.rb
 - lib/insika/context/providers/memory.rb
 - lib/insika/context/providers/prompt.rb
 - lib/insika/context/providers/request.rb
 - lib/insika/context/providers/session.rb
 - lib/insika/context/providers/skill.rb
+- lib/insika/context/providers/skill_trigger.rb
 - lib/insika/context/providers/tool_search.rb
+- lib/insika/context_trace_store.rb
 - lib/insika/delegation_store.rb
+- lib/insika/distill.rb
+- lib/insika/distill_engine.rb
 - lib/insika/doctor.rb
 - lib/insika/dsl.rb
 - lib/insika/dsl/definition.rb
@@ -265,36 +303,64 @@ files:
 - lib/insika/evals/transport.rb
 - lib/insika/event.rb
 - lib/insika/event_stream.rb
+- lib/insika/evidence.rb
 - lib/insika/executor.rb
+- lib/insika/followup_engine.rb
+- lib/insika/followup_policy.rb
+- lib/insika/followup_store.rb
 - lib/insika/frontmatter.rb
+- lib/insika/funnel_declaration.rb
+- lib/insika/funnel_fold.rb
+- lib/insika/funnel_store.rb
 - lib/insika/golden_store.rb
+- lib/insika/grounding.rb
+- lib/insika/grounding/matcher.rb
+- lib/insika/harvest.rb
+- lib/insika/harvest/conversion_gate.rb
+- lib/insika/harvest/criterion.rb
+- lib/insika/harvest/gate.rb
+- lib/insika/harvest/negative_list.rb
+- lib/insika/harvest_engine.rb
+- lib/insika/harvest_store.rb
 - lib/insika/hooks.rb
 - lib/insika/http_client.rb
 - lib/insika/inbound_log.rb
 - lib/insika/llm_configurator.rb
 - lib/insika/llm_provider_store.rb
+- lib/insika/loop_detector.rb
 - lib/insika/mcp_http_client.rb
 - lib/insika/mcp_store.rb
 - lib/insika/mcp_tool_ingestor.rb
+- lib/insika/media.rb
+- lib/insika/memory_audit_store.rb
 - lib/insika/memory_store.rb
 - lib/insika/message_origin.rb
 - lib/insika/middleware.rb
 - lib/insika/model_policy.rb
 - lib/insika/model_resolver.rb
 - lib/insika/model_selection.rb
+- lib/insika/model_visible.rb
+- lib/insika/model_visible_trace_store.rb
 - lib/insika/onboarding.rb
 - lib/insika/outbox_store.rb
+- lib/insika/outcome_store.rb
 - lib/insika/overlay_tool_registry.rb
 - lib/insika/pack.rb
 - lib/insika/pack_importer.rb
+- lib/insika/packaging.rb
+- lib/insika/parity/criterion.rb
+- lib/insika/parity/verdict.rb
 - lib/insika/pending_action_store.rb
 - lib/insika/plugin.rb
 - lib/insika/plugin/loader.rb
 - lib/insika/policy/engine.rb
 - lib/insika/policy/policy.rb
 - lib/insika/policy_registry.rb
+- lib/insika/prefix_fingerprint.rb
 - lib/insika/profile_source.rb
 - lib/insika/prompt_catalog.rb
+- lib/insika/proposal_store.rb
+- lib/insika/provider_error_classifier.rb
 - lib/insika/queue_policy.rb
 - lib/insika/recovery.rb
 - lib/insika/refinement/candidate.rb
@@ -304,9 +370,15 @@ files:
 - lib/insika/refinement/proposer.rb
 - lib/insika/refinement_store.rb
 - lib/insika/registry.rb
+- lib/insika/reliability.rb
+- lib/insika/retention.rb
+- lib/insika/routing.rb
 - lib/insika/safety/config.rb
+- lib/insika/safety/corpus.rb
 - lib/insika/safety/detectors.rb
 - lib/insika/safety/factory.rb
+- lib/insika/safety/grounding_enforcer.rb
+- lib/insika/safety/grounding_validator.rb
 - lib/insika/safety/input_guardrail.rb
 - lib/insika/safety/moderator.rb
 - lib/insika/safety/output_filter.rb
@@ -328,18 +400,22 @@ files:
 - lib/insika/server/a2a/protocol.rb
 - lib/insika/server/a2a/remotes.rb
 - lib/insika/server/a2a/task_projection.rb
-- lib/insika/server/admin_auth.rb
 - lib/insika/server/app.rb
 - lib/insika/server/boot.rb
 - lib/insika/server/rack_app.rb
 - lib/insika/server/responses.rb
 - lib/insika/server/sse_body.rb
+- lib/insika/server/tenant_auth.rb
 - lib/insika/session_actor.rb
 - lib/insika/session_store.rb
 - lib/insika/settings_store.rb
+- lib/insika/shadow_pair_store.rb
 - lib/insika/shutdown.rb
 - lib/insika/skill_catalog.rb
 - lib/insika/skill_store.rb
+- lib/insika/soak/envelope.rb
+- lib/insika/soak/report.rb
+- lib/insika/soak/runner.rb
 - lib/insika/steer_injector.rb
 - lib/insika/store.rb
 - lib/insika/stores/memory.rb
@@ -347,6 +423,7 @@ files:
 - lib/insika/studio/app.rb
 - lib/insika/studio/assets/dist/application.css
 - lib/insika/studio/assets/dist/application.js
+- lib/insika/studio/assets/dist/favicon.svg
 - lib/insika/studio/forms.rb
 - lib/insika/studio/nav_icons.rb
 - lib/insika/studio/views/_message.erb
@@ -354,12 +431,19 @@ files:
 - lib/insika/studio/views/agents.erb
 - lib/insika/studio/views/approvals.erb
 - lib/insika/studio/views/chats.erb
+- lib/insika/studio/views/customer.erb
+- lib/insika/studio/views/customers.erb
 - lib/insika/studio/views/evals.erb
+- lib/insika/studio/views/facts.erb
+- lib/insika/studio/views/followups.erb
+- lib/insika/studio/views/funnel.erb
+- lib/insika/studio/views/harvest.erb
 - lib/insika/studio/views/home.erb
 - lib/insika/studio/views/layout.erb
 - lib/insika/studio/views/login.erb
 - lib/insika/studio/views/mcp.erb
 - lib/insika/studio/views/not_found.erb
+- lib/insika/studio/views/parity.erb
 - lib/insika/studio/views/playground.erb
 - lib/insika/studio/views/refinement.erb
 - lib/insika/studio/views/session.erb
@@ -378,12 +462,15 @@ files:
 - lib/insika/telemetry/pricing.rb
 - lib/insika/telemetry/recorder.rb
 - lib/insika/testing/store_contract.rb
+- lib/insika/tick.rb
 - lib/insika/token_estimator.rb
+- lib/insika/token_store.rb
 - lib/insika/tool_assembly.rb
 - lib/insika/tool_catalog.rb
 - lib/insika/tool_definition.rb
 - lib/insika/tool_envelope.rb
 - lib/insika/tool_manifest.rb
+- lib/insika/tool_output_compressor.rb
 - lib/insika/tool_registry.rb
 - lib/insika/tool_store.rb
 - lib/insika/tool_trace_store.rb
@@ -391,16 +478,22 @@ files:
 - lib/insika/tools/agent_enum.rb
 - lib/insika/tools/concurrency.rb
 - lib/insika/tools/data_defined_tool.rb
+- lib/insika/tools/generate_image.rb
 - lib/insika/tools/load_skill.rb
 - lib/insika/tools/remember.rb
+- lib/insika/tools/schedule_followup.rb
+- lib/insika/tools/stuck_signal.rb
 - lib/insika/tools/subagent.rb
 - lib/insika/tools/subagents.rb
 - lib/insika/tools/tool_search.rb
+- lib/insika/tools/tts.rb
+- lib/insika/tools/update_briefing.rb
 - lib/insika/turn_output.rb
 - lib/insika/turn_state.rb
 - lib/insika/turn_timing.rb
 - lib/insika/usage_ledger.rb
 - lib/insika/version.rb
+- lib/insika/vitals.rb
 - lib/insika/wiring/graph.rb
 - lib/insika/workflow.rb
 - lib/insika/workflow_registry.rb

data/lib/insika/server/admin_auth.rb

@@ -1,29 +0,0 @@
-# frozen_string_literal: true
-
-require "rack"
-require "rack/utils"
-
-module Insika
-  module Server
-    # Minimal operator auth. Fail-closed BY CONSTRUCTION: with no
-    # token configured, /admin does not exist to the world (503) — never open
-    # by omission. Pure module, testable without a Rack env.
-    module AdminAuth
-      module_function
-
-      # config_token: config[:admin_token] (the wiring reads ADMIN_TOKEN).
-      # header: raw Authorization value.
-      # -> :disabled | :unauthorized | :ok
-      def check(config_token, header)
-        return :disabled if config_token.nil? || config_token.empty?
-
-        provided = header.to_s[/\ABearer (.+)\z/, 1]
-        return :unauthorized if provided.nil?
-        # Constant-time comparison: the operator token doesn't leak via timing.
-        return :unauthorized unless Rack::Utils.secure_compare(config_token, provided)
-
-        :ok
-      end
-    end
-  end
-end