insika 0.2.0 → 0.3.0

data/lib/insika/routing.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+module Insika
+  # WS4: intent routing as DATA. When `AgentProfile#routes` is present, the
+  # turn's message is classified into one of the configured routes with a cheap
+  # model BEFORE the agent chat is assembled. This class owns the PURE parts —
+  # normalizing the route config, generating the classifier prompt from the
+  # route descriptions, and parsing the model's answer back into a route — so
+  # they are testable without a provider. The ask itself and its usage are the
+  # Executor's (a pre-stage call counted in the turn's usage and trace).
+  #
+  # Config shape (string keys at the persistence boundary — the pack and the
+  # Studio store it like any other free-form hash):
+  #
+  #   { "shopping" => "the customer wants to browse products",
+  #     "order"    => { "description" => "asks about an existing order",
+  #                     "delegate" => "order-agent" },     # hand the turn to that agent
+  #     "human"    => { "description" => "the customer is frustrated or asks for a person",
+  #                     "stuck" => true, "message" => "..." }, # end the turn :stuck (WS5)
+  #     "default"  => "shopping",                            # deterministic fallback
+  #     "model"    => "deepseek-v4-flash" }                  # the CHEAP classifier
+  #
+  # `default`/`model`/`provider` are reserved top-level keys; everything else is
+  # a route name (single token). A route value is a description String or a Hash
+  # with `description` + optional `delegate` (an existing agent the turn is
+  # handed to) / `stuck` (the turn ends with the WS5 stuck outcome) / `message`
+  # (the consumer-facing lead-in for a stuck route).
+  class Routing
+    RESERVED = %w[model provider default].freeze
+    # A name the classifier can actually answer with: one lowercase token.
+    NAME = /\A[a-z0-9][a-z0-9_-]*\z/
+    # The turn's usage fields the classifier call can contribute.
+    TOKEN_FIELDS = %i[input_tokens output_tokens cached_tokens cache_creation_tokens total_tokens].freeze
+
+    Entry = Data.define(:name, :description, :delegate, :stuck, :message)
+
+    class << self
+      # -> { entries: [Entry], default: String, model: String, provider: String }
+      # | nil (routes absent/empty = routing off). Raises ValidationError on a
+      # route name the classifier could never answer with (spaces/symbols) or on
+      # a config with zero routes — a routing config that silently routes nothing
+      # is a config error, not a quiet off.
+      def normalize(routes)
+        return nil unless routes.is_a?(Hash) && !routes.empty?
+
+        bad = routes.keys.map(&:to_s).reject { |k| RESERVED.include?(k) || k.match?(NAME) }
+        unless bad.empty?
+          raise Insika::ValidationError,
+                "route names may not contain spaces or symbols: #{bad.join(', ')}"
+        end
+
+        entries = routes.each_with_object([]) do |(name, value), acc|
+          next if RESERVED.include?(name.to_s)
+
+          cfg = value.is_a?(Hash) ? stringify(value) : { "description" => value.to_s }
+          acc << Entry.new(name: name.to_s, description: cfg["description"].to_s,
+                           delegate: cfg["delegate"].to_s, stuck: cfg["stuck"] == true,
+                           message: cfg["message"].to_s)
+        end
+        raise Insika::ValidationError, "routes must define at least one route" if entries.empty?
+
+        default = routes["default"].to_s
+        default = entries.first.name if default.empty?
+        unless entries.any? { |e| e.name == default }
+          raise Insika::ValidationError,
+                "default route '#{default}' is not a configured route"
+        end
+        { entries: entries, default: default,
+          model: routes["model"].to_s, provider: routes["provider"].to_s }
+      end
+
+      # The classifier's instructions, auto-generated from the route descriptions
+      # (config-over-code: no per-route prompt file).
+      def classifier_prompt(meta)
+        lines = meta[:entries].map do |e|
+          "-#{e.name}: #{e.description.empty? ? e.name : e.description}"
+        end
+        <<~PROMPT
+          Classify the customer's message into exactly one of these intents.
+          Reply with ONLY the intent name — nothing else.
+
+          #{lines.join("\n")}
+        PROMPT
+      end
+
+      # -> Symbol: the route the model named; the DEFAULT when it named nothing
+      # usable (prose, punctuation, an unknown name, empty). Deterministic by
+      # construction — a chatty or confused classifier can never invent a route.
+      def parse(text, meta)
+        token = text.to_s.strip.split(/\s+/).first.to_s.downcase
+                    .delete_suffix(".").delete_suffix(",")
+        names = meta[:entries].map(&:name)
+        (names.include?(token) ? token : meta[:default]).to_sym
+      end
+    end
+
+    def self.stringify(hash)
+      hash.each_with_object({}) { |(k, v), acc| acc[k.to_s] = v }
+    end
+  end
+end

data/lib/insika/safety/config.rb

@@ -16,8 +16,19 @@ module Insika
     #     moderator:  "provider/model"|nil,  # LLM moderator model; nil = deterministic only
     #     strictness: "low"|"medium"|"high", # which input categories fire (default medium)
     #     responses:  { <category> => "<safe reply>", ... }  # per-agent override, see below
+    #     corpora:    { "languages" => ["en"], "extra" => { "abuse" => ["/\\bdupa\\b/i"] } }
     #   }
     #
+    # `corpora`  is the removability knob for the shipped
+    # pt-BR corpus: `languages` filters the shipped families (nil = all,
+    # [] = none, ["en"] = the EN-only corpus — dropping the pt-BR input
+    # heuristics AND the CPF/CNPJ output redaction, a documented consequence),
+    # `extra` adds source-string patterns per family. Absent = the full
+    # shipped default, byte-for-byte today's behavior (parity). Validation
+    # fails loud (Insika::ValidationError naming the value): the doctor's
+    # guardrail-corpora check compiles every declaration, so a typo'd language
+    # surfaces at boot — `insika doctor` exits non-zero — never mid-turn.
+    #
     # `responses` is the CONFIGURATION-OVER-CONVENTION knob. The engine
     # ships neutral built-in refusals (Safety::SafeResponses::DEFAULTS), but this is
     # OSS across arbitrary businesses/languages, so we never hard-bake tone: an agent
@@ -37,14 +48,18 @@ module Insika
 
       DEFAULT_STRICTNESS = :medium
 
-      attr_reader :input, :output, :moderator, :strictness, :responses
+      attr_reader :input, :output, :moderator, :strictness, :responses, :corpora
 
-      def initialize(input:, output:, moderator:, strictness:, responses: {})
+      def initialize(input:, output:, moderator:, strictness:, responses: {}, corpora: nil)
         @input = input
         @output = output
         @moderator = moderator
         @strictness = strictness
         @responses = responses # { "category" => "safe reply" }, agent override map
+        @corpora = corpora     # { "languages" => [...]?, "extra" => {...}? } | nil (nil = the shipped default)
+        # Built ONCE at construction: the compiled corpus the whole turn reads.
+        @corpus = Corpus.compile(languages: corpora && corpora["languages"],
+                                 extra: (corpora && corpora["extra"]) || {})
       end
 
       # Builds a Config from a profile. A nil/empty `guardrails` -> the
@@ -58,10 +73,22 @@ module Insika
           output: bool(h.fetch(:output, true)),
           moderator: presence(h[:moderator]),
           strictness: normalize_strictness(h[:strictness]),
-          responses: normalize_responses(h[:responses])
+          responses: normalize_responses(h[:responses]),
+          corpora: normalize_corpora(h[:corpora])
         )
       end
 
+      # The compiled corpus for this agent  — never nil: absent
+      # corpora -> the full shipped default.
+      def corpus = @corpus
+
+      # The resolved corpus languages (for the doctor's enumeration, C3):
+      # nil corpora (or nil languages) = ALL shipped languages.
+      def corpus_languages
+        langs = @corpora && @corpora["languages"]
+        langs.nil? ? Corpus::DEFAULTS.keys : langs
+      end
+
       # Input categories the deterministic scan should run, per strictness.
       def input_categories = STRICTNESS_CATEGORIES.fetch(@strictness, STRICTNESS_CATEGORIES[DEFAULT_STRICTNESS])
 
@@ -103,7 +130,20 @@ module Insika
         end
       end
 
-      private_class_method :symbolize, :bool, :presence, :normalize_strictness, :normalize_responses
+      # `corpora` -> { "languages" => ...?, "extra" => ...? } with STRING keys |
+      # nil when absent/empty. Validation of the values happens in
+      # Corpus.compile (from_hash fails loud with the value named).
+      def self.normalize_corpora(v)
+        return nil unless v.is_a?(Hash)
+
+        h = v.each_with_object({}) { |(k, val), acc| acc[k.to_s] = val }
+        return nil if h["languages"].nil? && h["extra"].nil?
+
+        { "languages" => h["languages"], "extra" => h["extra"] }
+      end
+
+      private_class_method :symbolize, :bool, :presence, :normalize_strictness, :normalize_responses,
+                           :normalize_corpora
     end
   end
 end

data/lib/insika/safety/corpus.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+module Insika
+  module Safety
+    # The SHIPPED deterministic guardrail corpus as language-tagged DATA
+    # Pure data — no Insika requires, standalone-loadable
+    # like detectors.rb used to be.
+    #
+    # Pattern SOURCE now lives here; `Detectors` is the compiler/matcher on
+    # top. The runtime compiles a per-agent `Compiled` set — a deployment
+    # clears the pt-BR families via `guardrails.corpora.languages` and extends
+    # them via `guardrails.corpora.extra` (docs/domain.md). Absent config = the
+    # full shipped default: byte-for-byte today's behavior (parity).
+    #
+    # LANGUAGE: each regex lives in exactly ONE language. `compile` (no args)
+    # is the union of the shipped languages, each family in its shipped order.
+    # For a single-language input the default behaves exactly as the runtime
+    # that hard-coded one flat list — the ONE honest delta: the previous flat
+    # list INTERLEAVED the languages, so for a phrase matching patterns of
+    # BOTH languages the reported `matched` substring may differ (the
+    # category never does). Pinned in spec/insika/safety/corpus_spec.rb.
+    module Corpus
+      # ── The shipped input families ─────────────────────────────────────────
+      # "injection"/"sexual"/"abuse" per language. High-confidence heuristics
+      # that short-circuit the turn BEFORE the LLM runs (conservative by
+      # design — a false positive blocks a legitimate customer; the subtler
+      # judgment is the LLM moderator's).
+      DEFAULTS = {
+        "pt-BR" => {
+          "injection" => [
+            /\binstru[çc][õo]es\s+de\s+sistema\b/i,
+            /\b(regras|instru[çc][õo]es|orienta[çc][õo]es|diretrizes)\s+internas\b/i,
+            /\b(revele|mostre|exiba|me\s+(d[êe]|mande|envie|passe)|repita|imprima)\b[^.?!]{0,40}\b(prompt|instru[çc][õo]es|regras|configura[çc][ãa]o|system)\b/i,
+            # "ignore/disregard the (previous) instructions"
+            /\b(ignore|ignora|desconsidere|esque[çc]a)\b[^.?!]{0,30}\b(instru[çc][õo]es|regras|orienta[çc][õo]es|acima|anteriores)\b/i,
+            # encode/translate the prompt (the base64/rot13 exfil trick, either order)
+            /\b(base64|rot13|codific|encode|cifr)\w*\b[^.?!]{0,60}\b(instru[çc][õo]es|prompt|regras|sistema|system)\b/i,
+            /\b(instru[çc][õo]es|prompt|regras|sistema|system)\b[^.?!]{0,60}\b(base64|rot13|codific|encode|cifr)\w*\b/i
+          ],
+          "sexual" => [
+            /\b(nudes?|pelad[oa]s?|s?exo|transar|transa\b|gozar|tes[ãa]o|s[ãa]fad[oa]|puta|pau|buceta|piroca|caralho\s+(duro|na))\b/i,
+            /\bo\s+que\s+voc[êe]\s+faria\s+comigo\b/i,
+            /\b(descrev|imagina|conta)\w*\b[^.?!]{0,30}\bcomigo\s+(na\s+cama|pelad)/i,
+            /\b(quer|vamos)\b[^.?!]{0,20}\b(transar|fazer\s+sexo|sexo)\b/i
+          ],
+          "abuse" => [
+            # Directed insult only — "a entrega foi uma merda" must NOT block;
+            # "você é uma merda de atendente" should. The `você é …` anchor
+            # keeps precision high.
+            /\bvoc[êe]\s+(é|e|ta|est[áa])\b[^.?!]{0,25}\b(lixo|in[uú]til|merda|imprest[aá]vel|idiota|burr[oa]|est[uú]pid[oa]|otári[oa]|in[uú]teis|incompetente|p[áa]ssim[oa])\b/i,
+            /\b(seu|sua)\s+(lixo|in[uú]til|idiota|imbecil|otári[oa]|burr[oa]|est[uú]pid[oa]|merda|escrot[oa])\b/i,
+            /\bvai\s+(se\s+)?(fuder|foder|tomar\s+no)\b/i
+          ]
+        },
+        "en" => {
+          "injection" => [
+            /\bsystem\s*prompt\b/i,
+            /\b(ignore|disregard|forget)\b[^.?!]{0,30}\b(instructions|rules|prompt|above|previous|prior)\b/i
+          ],
+          "sexual" => [
+            /\b(horny|blow\s?job|hand\s?job|jerk\s+off|have\s+sex|send\s+(me\s+)?(a\s+)?nudes?|dick\s+pic)\b/i,
+            /\bwhat\s+(would|will)\s+you\s+do\s+to\s+me\b/i
+          ],
+          "abuse" => [
+            # Directed insult only (keeps precision high; frustration ≠ abuse)
+            /\byou\s*(?:'?re|\s+are)\b[^.?!]{0,25}\b(useless|garbage|trash|idiot|stupid|worthless|pathetic|incompetent|dumb|a\s+joke)\b/i,
+            /\b(fuck|screw)\s+you\b/i,
+            /\byou\s+(suck|are\s+the\s+worst)\b/i
+          ]
+        }
+      }.freeze
+
+      # ── The shipped OUTPUT detectors (PII/secret redaction targets) ────────
+      # Language-tagged: "secret" is universal (never cleared); "cpf"/"cnpj"
+      # are pt-BR tax-id formats — an EN-only corpus drops them (documented
+      # consequence, docs/domain.md). Key ORDER is the previous runtime's
+      # (cpf, cnpj, secret) — it is what `pii_names` and the "pii_leak" union
+      # iterate.
+      PII = {
+        "cpf" => {
+          "languages" => ["pt-BR"],
+          "pattern" => /\b\d{3}\.\d{3}\.\d{3}-\d{2}\b/
+        },
+        "cnpj" => {
+          "languages" => ["pt-BR"],
+          "pattern" => /\b\d{2}\.\d{3}\.\d{3}\/\d{4}-\d{2}\b/
+        },
+        "secret" => {
+          "languages" => nil,
+          "pattern" => /\b(?:sk-[A-Za-z0-9]{16,}|Bearer\s+[A-Za-z0-9._-]{16,})\b/
+        }
+      }.freeze
+
+      # A run of the output stream that MIGHT still be growing into a
+      # PII/secret match if more chunks arrive — anchored at the buffer tail
+      # (the OutputFilter's hold-back). Universal: it covers the unbounded
+      # `sk-…`/`Bearer …` shapes and the in-progress CPF/CNPJ digit runs.
+      OPEN_TAIL = %r{
+        (?:
+          s(?:k(?:-[A-Za-z0-9]*)?)?                    # prefix of "sk-" + optional body
+          | B(?:e(?:a(?:r(?:e(?:r(?:\s+[A-Za-z0-9._-]*)?)?)?)?)?)?  # prefix of "Bearer " + body
+          | \d[\d./-]*                                 # in-progress CPF/CNPJ digit run
+        )\z
+      }x
+
+      # The compiled corpus for ONE agent: the input families + output
+      # detectors filtered by its languages and extended by its `extra`
+      # patterns. Immutable (Data + deep-frozen collections) and shared safely.
+      Compiled = Data.define(:languages, :input, :pii) do
+        # The subset of `categories` (symbols) that have patterns in this
+        # corpus — the strictness gate applied to the compiled set.
+        def input_categories(categories)
+          categories.select { |cat| Array(input[cat.to_s]).any? }
+        end
+
+        # Runs a NAMED output detector over `text` -> the matched substring |
+        # nil. "pii_leak" = union of all patterns; an entirely UNKNOWN name
+        # fails LOUD (a typo'd assertion must never silently pass); a name the
+        # corpus knows but whose language was cleared matches nothing.
+        def detect_output(name, text)
+          patterns =
+            if name.to_s == "pii_leak"
+              pii.values
+            else
+              p = pii[name.to_s]
+              if p.nil? && !Corpus::PII.key?(name.to_s)
+                raise ArgumentError, "unknown detector: #{name.inspect}"
+              end
+
+              p ? [p] : []
+            end
+          patterns.each { |re| (m = text.to_s.match(re)) && (return m[0]) }
+          nil
+        end
+
+        # Replaces every PII/secret occurrence with an opaque `[REDACTED:<name>]`
+        # marker — the raw value NEVER survives. -> [redacted_text, {name => count}].
+        def redact(text)
+          counts = Hash.new(0)
+          out = text.to_s.dup
+          pii.each do |name, re|
+            out = out.gsub(re) do
+              counts[name] += 1
+              "[REDACTED:#{name}]"
+            end
+          end
+          [out, counts]
+        end
+
+        # [[begin, end), ...] byte-index ranges of every PII/secret match in
+        # `text` (used by the OutputFilter to avoid splitting a complete match
+        # at a chunk boundary).
+        def match_ranges(text)
+          ranges = []
+          pii.each_value do |re|
+            text.to_s.scan(re) { ranges << [Regexp.last_match.begin(0), Regexp.last_match.end(0)] }
+          end
+          ranges
+        end
+
+        # The universal open-tail pattern (see Corpus::OPEN_TAIL).
+        def open_tail = Corpus::OPEN_TAIL
+      end
+
+      KNOWN_FAMILIES = %w[injection sexual abuse].freeze
+
+      # -> Compiled. `languages`: nil = ALL shipped languages (parity default);
+      # [] = no shipped input family (only `extra`); ["en"] = the EN-only
+      # corpus. `extra`: { "abuse" => ["/\\bdupa\\b/i", ...] } — per-category
+      # additions in the source-string syntax (or Regexp objects), compiled
+      # with the same syntax. Raises Insika::ValidationError naming the value
+      # for an unknown language/family or a malformed pattern.
+      #
+      # Compiled values are immutable, so the result is MEMOIZED per signature:
+      # a turn builds Config several times (input middleware, output validator,
+      # filter factory) and each build must not re-compile the same patterns.
+      def self.compile(languages: nil, extra: {})
+        key = [languages.is_a?(Array) ? languages.sort : languages, extra]
+        @cache ||= {}
+        @cache[key] ||= build(languages, extra)
+      end
+
+      def self.build(languages, extra)
+        langs = languages.nil? ? DEFAULTS.keys : validate_languages!(languages)
+        extra = validate_extra!(extra)
+
+        input = {}
+        langs.each do |lang|
+          DEFAULTS.fetch(lang).each do |cat, patterns|
+            input[cat] = Array(input[cat]) + patterns
+          end
+        end
+        extra.each do |cat, sources|
+          input[cat.to_s] = Array(input[cat.to_s]) + Array(sources).map { |src| compile_pattern(src, cat) }
+        end
+
+        pii = {}
+        PII.each do |name, meta|
+          meta_langs = meta["languages"]
+          next if meta_langs && (meta_langs & langs).empty?
+
+          pii[name] = meta["pattern"]
+        end
+
+        # `langs.dup`: the caller's array is never frozen out from under it.
+        Compiled.new(
+          languages: langs.dup.freeze,
+          input: input.transform_values(&:freeze).freeze,
+          pii: pii.freeze
+        )
+      end
+      private_class_method :build
+
+      def self.validate_languages!(languages)
+        unless languages.is_a?(Array) && (languages - DEFAULTS.keys).empty?
+          raise Insika::ValidationError,
+                "guardrails.corpora.languages must be an Array of known languages " \
+                "(#{DEFAULTS.keys.join(", ")}), got: #{languages.inspect}"
+        end
+        languages
+      end
+
+      def self.validate_extra!(extra)
+        unless extra.is_a?(Hash) && (extra.keys.map(&:to_s) - KNOWN_FAMILIES).empty?
+          unknown = extra.is_a?(Hash) ? extra.keys.map(&:to_s) - KNOWN_FAMILIES : []
+          label = unknown.empty? ? extra.inspect : unknown.join(", ")
+          raise Insika::ValidationError,
+                "guardrails.corpora.extra must be a Hash with known families " \
+                "(#{KNOWN_FAMILIES.join(", ")}), got: #{label}"
+        end
+        extra
+      end
+
+      # A pattern source -> Regexp. Accepts the source-string syntax
+      # ("/\\bdupa\\b/i") or a bare pattern; Regexp objects pass through.
+      # A malformed source fails with the pattern named.
+      def self.compile_pattern(source, family)
+        return source if source.is_a?(Regexp)
+
+        s = source.to_s
+        if (m = s.match(%r{\A/(.*)/([a-z]*)\z}m))
+          Regexp.new(m[1], m[2])
+        else
+          Regexp.new(s)
+        end
+      rescue RegexpError => e
+        raise Insika::ValidationError,
+              "guardrails.corpora.extra.#{family}: invalid pattern source " \
+              "#{source.inspect} (#{e.message})"
+      end
+
+      private_class_method :validate_languages!, :validate_extra!, :compile_pattern
+    end
+  end
+end

data/lib/insika/safety/detectors.rb

@@ -1,8 +1,13 @@
 # frozen_string_literal: true
 
+require_relative "corpus"
+
 module Insika
   module Safety
-    # SINGLE SOURCE of truth for content-safety pattern matching.
+    # The compiler/matcher over the language-tagged pattern corpus (
+    # C2). The pattern SOURCE lives in `Safety::Corpus`; every method here
+    # reads a compiled `Corpus::Compiled` set, defaulting to the full shipped
+    # corpus — byte-for-byte the runtime's pre-  behavior.
     #
     # Two families live here on purpose — the same lists back BOTH the runtime
     # guardrail AND the eval's `must_not` detectors: the eval
@@ -16,151 +21,65 @@ module Insika
     #   · INPUT side (injection/abuse/sexual) — high-confidence heuristics that
     #     short-circuit the turn with a safe refusal BEFORE the LLM runs.
     #
-    # Everything here is CONSERVATIVE by design (RFC: a false positive blocks a
+    # Everything here is CONSERVATIVE by design: a false positive blocks a
     # legitimate customer). The deterministic layer catches only the gross,
     # unambiguous cases; the subtler judgment (social engineering, tone) is the LLM
     # moderator's job, not regex.
     #
     # LANGUAGE: the input heuristics are inherently language-specific. We ship pt-BR
     # + EN (the pilot + the OSS lingua franca) as a BEST-EFFORT net; other languages
-    # rely on the LLM moderator, which is language-agnostic. Adding a language = adding
-    # patterns to the arrays below — it never needs core changes.
+    # rely on the LLM moderator, which is language-agnostic. A deployment clears a
+    # language via `guardrails.corpora` (docs/domain.md) — adding a language is
+    # adding data to Corpus, never core changes.
     module Detectors
       module_function
 
-      # ── OUTPUT: PII / secret (redaction targets) ────────────────────────────
-      # Formatted BR CPF/CNPJ only — a bare digit run (an order number, a price) is
-      # too ambiguous to flag. Credential shapes that must never leak.
-      PII = {
-        "cpf"    => /\b\d{3}\.\d{3}\.\d{3}-\d{2}\b/,
-        "cnpj"   => /\b\d{2}\.\d{3}\.\d{3}\/\d{4}-\d{2}\b/,
-        "secret" => /\b(?:sk-[A-Za-z0-9]{16,}|Bearer\s+[A-Za-z0-9._-]{16,})\b/
-      }.freeze
-
-      # A run of the output stream that MIGHT still be growing into a PII/secret
-      # match if more chunks arrive — anchored at the buffer tail. The OutputFilter
-      # holds back from the start of such a run so a value split across chunk
-      # boundaries is never emitted in the clear (RFC). Covers the
-      # unbounded `sk-…`/`Bearer …` case that a fixed window cannot.
-      #
-      # Crucially it also matches a PARTIAL literal PREFIX at the tail — a lone "s"
-      # (start of "sk-"), "Bear" (start of "Bearer "), a trailing digit run — because
-      # the prefix ITSELF can be split across chunks (emitting the "s" then matching
-      # "k-…" alone would miss the secret entirely). The cost is a few chars of tail
-      # latency on words ending in "s"/"B"/a digit, released on the next chunk or flush.
-      OPEN_TAIL = %r{
-        (?:
-          s(?:k(?:-[A-Za-z0-9]*)?)?                    # prefix of "sk-" + optional body
-          | B(?:e(?:a(?:r(?:e(?:r(?:\s+[A-Za-z0-9._-]*)?)?)?)?)?)?  # prefix of "Bearer " + body
-          | \d[\d./-]*                                 # in-progress CPF/CNPJ digit run
-        )\z
-      }x
-
-      # ── INPUT: prompt-injection / exfiltration ──────────────────────────────
-      INJECTION = [
-        # exfil of the system prompt / internal rules
-        /\binstru[çc][õo]es\s+de\s+sistema\b/i,
-        /\bsystem\s*prompt\b/i,
-        /\b(regras|instru[çc][õo]es|orienta[çc][õo]es|diretrizes)\s+internas\b/i,
-        /\b(revele|mostre|exiba|me\s+(d[êe]|mande|envie|passe)|repita|imprima)\b[^.?!]{0,40}\b(prompt|instru[çc][õo]es|regras|configura[çc][ãa]o|system)\b/i,
-        # "ignore/disregard the (previous) instructions"
-        /\b(ignore|ignora|desconsidere|esque[çc]a)\b[^.?!]{0,30}\b(instru[çc][õo]es|regras|orienta[çc][õo]es|acima|anteriores)\b/i,
-        /\b(ignore|disregard|forget)\b[^.?!]{0,30}\b(instructions|rules|prompt|above|previous|prior)\b/i,
-        # encode/translate the prompt (the base64/rot13 exfil trick, either order)
-        /\b(base64|rot13|codific|encode|cifr)\w*\b[^.?!]{0,60}\b(instru[çc][õo]es|prompt|regras|sistema|system)\b/i,
-        /\b(instru[çc][õo]es|prompt|regras|sistema|system)\b[^.?!]{0,60}\b(base64|rot13|codific|encode|cifr)\w*\b/i
-      ].freeze
-
-      # ── INPUT: sexual / inappropriate ───────────────────────────────────────
-      # pt-BR + EN. Deterministic coverage is best-effort per language (see the
-      # module note): other languages fall to the LLM moderator (language-agnostic).
-      SEXUAL = [
-        /\b(nudes?|pelad[oa]s?|s?exo|transar|transa\b|gozar|tes[ãa]o|s[ãa]fad[oa]|puta|pau|buceta|piroca|caralho\s+(duro|na))\b/i,
-        /\bo\s+que\s+voc[êe]\s+faria\s+comigo\b/i,
-        /\b(descrev|imagina|conta)\w*\b[^.?!]{0,30}\bcomigo\s+(na\s+cama|pelad)/i,
-        /\b(quer|vamos)\b[^.?!]{0,20}\b(transar|fazer\s+sexo|sexo)\b/i,
-        # EN
-        /\b(horny|blow\s?job|hand\s?job|jerk\s+off|have\s+sex|send\s+(me\s+)?(a\s+)?nudes?|dick\s+pic)\b/i,
-        /\bwhat\s+(would|will)\s+you\s+do\s+to\s+me\b/i
-      ].freeze
-
-      # ── INPUT: verbal abuse / harassment (directed at the assistant) ─────────
-      # Directed insult only — "a entrega foi uma merda" (frustration about the
-      # service) must NOT block; "você é uma merda de atendente" (insult at the bot)
-      # should. The `você é …` anchor keeps precision high.
-      ABUSE = [
-        /\bvoc[êe]\s+(é|e|ta|est[áa])\b[^.?!]{0,25}\b(lixo|in[uú]til|merda|imprest[aá]vel|idiota|burr[oa]|est[uú]pid[oa]|otári[oa]|in[uú]teis|incompetente|p[áa]ssim[oa])\b/i,
-        /\b(seu|sua)\s+(lixo|in[uú]til|idiota|imbecil|otári[oa]|burr[oa]|est[uú]pid[oa]|merda|escrot[oa])\b/i,
-        /\bvai\s+(se\s+)?(fuder|foder|tomar\s+no)\b/i,
-        # EN — directed insult only (keeps precision high; frustration ≠ abuse)
-        /\byou\s*(?:'?re|\s+are)\b[^.?!]{0,25}\b(useless|garbage|trash|idiot|stupid|worthless|pathetic|incompetent|dumb|a\s+joke)\b/i,
-        /\b(fuck|screw)\s+you\b/i,
-        /\byou\s+(suck|are\s+the\s+worst)\b/i
-      ].freeze
-
-      # ── OUTPUT helpers ──────────────────────────────────────────────────────
+      # The universal open-tail pattern — the prefix of a PII/secret shape
+      # that might still be growing. Lives in the corpus data (universal, not
+      # language-tagged); kept here for the module's readers.
+      OPEN_TAIL = Corpus::OPEN_TAIL
 
       # Runs a NAMED output detector over `text` -> the matched substring | nil.
       # "pii_leak" = union of all PII patterns; otherwise a single named pattern.
       # Unknown name fails LOUD (a typo'd assertion must never silently pass).
-      def detect(name, text)
-        patterns =
-          if name.to_s == "pii_leak"
-            PII.values
-          else
-            p = PII[name.to_s]
-            raise ArgumentError, "unknown detector: #{name.inspect}" unless p
-
-            [p]
-          end
-        patterns.each { |re| (m = text.to_s.match(re)) && (return m[0]) }
-        nil
+      # `corpus:` — the compiled set for the agent; nil = the full default.
+      def detect(name, text, corpus: nil)
+        (corpus || Corpus.compile).detect_output(name, text)
       end
 
       # Names of the PII detectors (for iteration by the eval / config).
-      def pii_names = PII.keys
+      def pii_names(corpus: nil) = (corpus || Corpus.compile).pii.keys
 
       # [[begin, end), ...] byte-index ranges of every PII/secret match in `text`
       # (used by the OutputFilter to avoid splitting a complete match at a chunk
       # boundary).
-      def match_ranges(text)
-        ranges = []
-        PII.each_value do |re|
-          text.to_s.scan(re) { ranges << [Regexp.last_match.begin(0), Regexp.last_match.end(0)] }
-        end
-        ranges
+      def match_ranges(text, corpus: nil)
+        (corpus || Corpus.compile).match_ranges(text)
       end
 
       # Replaces every PII/secret occurrence with an opaque `[REDACTED:<name>]`
       # marker — the raw value NEVER survives (D "o redigido nunca aparece em
       # claro"). -> [redacted_text, {name => count}].
-      def redact(text)
-        counts = Hash.new(0)
-        out = text.to_s.dup
-        PII.each do |name, re|
-          out = out.gsub(re) do
-            counts[name] += 1
-            "[REDACTED:#{name}]"
-          end
-        end
-        [out, counts]
+      def redact(text, corpus: nil)
+        (corpus || Corpus.compile).redact(text)
       end
 
-      # ── INPUT helpers ───────────────────────────────────────────────────────
-
       # Scans a user message against the input heuristics, gated by strictness
-      # (see Insika::Safety::Config). Returns { category:, matched: } for the FIRST
-      # category that fires (injection is checked first — the highest-stakes), or
-      # nil when the message is clean. `categories` limits which families run.
+      # (see Insika::Safety::Config) and by the agent's compiled corpus.
+      # Returns { category:, matched: } for the FIRST category that fires
+      # (injection is checked first — the highest-stakes), or nil when the
+      # message is clean. `categories` limits which families run.
       #
       #   :injection -> always high confidence
       #   :sexual    -> medium+
       #   :abuse     -> medium+
-      def scan_input(text, categories: %i[injection sexual abuse])
+      def scan_input(text, categories: %i[injection sexual abuse], corpus: nil)
+        compiled = corpus || Corpus.compile
         s = text.to_s
-        return { category: :injection, matched: first_match(INJECTION, s) } if categories.include?(:injection) && any?(INJECTION, s)
-        return { category: :sexual, matched: first_match(SEXUAL, s) }        if categories.include?(:sexual) && any?(SEXUAL, s)
-        return { category: :abuse, matched: first_match(ABUSE, s) }          if categories.include?(:abuse) && any?(ABUSE, s)
+        cats = compiled.input_categories(categories)
+        return { category: :injection, matched: first_match(compiled.input["injection"], s) } if cats.include?(:injection) && any?(compiled.input["injection"], s)
+        return { category: :sexual, matched: first_match(compiled.input["sexual"], s) }        if cats.include?(:sexual) && any?(compiled.input["sexual"], s)
+        return { category: :abuse, matched: first_match(compiled.input["abuse"], s) }          if cats.include?(:abuse) && any?(compiled.input["abuse"], s)
 
         nil
       end