insika 0.2.0 → 0.3.0

data/lib/insika/studio/app.rb

@@ -81,10 +81,18 @@ module Studio
       def configure(command_bus:, profile_source:, event_stream:, config:,
                     agent_file_store: nil, skill_store: nil, skill_catalog: nil,
                     tool_catalog: nil, tool_store: nil, memory_store: nil, session_store: nil,
+                    memory_audit_store: nil,
                     settings_store: nil, llm_provider_store: nil, mcp_store: nil,
                     system_file_store: nil, tool_trace_store: nil, context_trace_store: nil,
+                    cache_series_store: nil,
                     task_store: nil, checkpoint_store: nil, pending_action_store: nil,
-                    refinement_store: nil, golden_store: nil, session_secret: nil)
+                    refinement_store: nil, golden_store: nil, session_secret: nil,
+                    outcome_store: nil, shadow_pair_store: nil, parity_criterion: nil,
+                    funnel_store: nil, budget_ledger: nil,
+                    followup_store: nil, contact_store: nil,
+                    proposal_store: nil,
+                    harvest_store: nil, harvest_criterion: nil, negative_list: nil,
+                    channel_registry: nil)
         @insika = {
           command_bus: command_bus, profile_source: profile_source,
           event_stream: event_stream, config: config,
@@ -94,6 +102,9 @@ module Studio
           # shows the data-tools in the matrix; the store feeds the authoring page.
           tool_store: tool_store,
           memory_store: memory_store, session_store: session_store,
+          # the Customers drill renders the audit lines (digests +
+          # counts, never content). nil = the audit section renders empty.
+          memory_audit_store: memory_audit_store,
           # runtime config (settings/LLM/MCP) + global system
           # files + conversations index. All optional (empty-state if nil).
           settings_store: settings_store, llm_provider_store: llm_provider_store,
@@ -104,6 +115,10 @@ module Studio
           # per-session context breakdown: tokens by category +
           # budget per turn, on the same viewer. Counts only, no content.
           context_trace_store: context_trace_store,
+          # per-AGENT cache-hit series (percentages + counts, no
+          # content) — the cache tab on the agent detail. nil = tab renders
+          # "No turns recorded.".
+          cache_series_store: cache_series_store,
           # operate: tasks + human-in-the-loop approvals. Reads the
           # task/checkpoint/pending stores to render; controls (pause/resume/
           # cancel/approve) dispatch on the bus — parity with server/admin.
@@ -113,7 +128,37 @@ module Studio
           # Read-only here; the "Run" button dispatches :run_refinement on the bus.
           refinement_store: refinement_store,
           # eval cases: read to render; writes go through:write_golden.
-          golden_store: golden_store
+          golden_store: golden_store,
+          # WS7: business outcomes — the agents grid's last-outcome pill; the
+          # agent detail shows the per-day series. Reads only; recording goes
+          # through POST /v1/outcomes.
+          outcome_store: outcome_store,
+          # the Funnel page reads the fold's cells and the
+          # BudgetLedger's current counters (D6). nil = the page renders its
+          # empty state.
+          funnel_store: funnel_store, budget_ledger: budget_ledger,
+          # the shadow pair store (read to render /studio/parity), the
+          # frozen criterion (folded by Verdict), and the channel registry (the
+          # nav row only exists when a shadow channel is registered — the page
+          # is not an invitation, unlike Refinement's).
+          shadow_pair_store: shadow_pair_store, parity_criterion: parity_criterion,
+          channel_registry: channel_registry,
+          # the Follow-ups page READS the stores directly;
+          # its only mutations — cancel a pending record, force-revoke a contact
+          # — dispatch :cancel_followup / :revoke_contact on the bus. nil = the
+          # page renders its empty state.
+          followup_store: followup_store, contact_store: contact_store,
+          # the Facts (wiki) page reads the proposal store directly
+          # (approvals/rejections dispatch :resolve_proposal on the bus).
+          # nil = the page renders its empty state.
+          proposal_store: proposal_store,
+          # the Harvest page reads the harvest store directly
+          # (the pending/awaiting/promoted lists); its mutations — mine, gate,
+          # promote, reject, rollback — dispatch bus commands. The criterion
+          # (boot-loaded, with its sha) and the negative list render the two
+          # pre-registered artifacts. nil = the page renders its empty state.
+          harvest_store: harvest_store, harvest_criterion: harvest_criterion,
+          negative_list: negative_list
         }.freeze
         # "restart recommended" flag — in memory, PER PROCESS. A
         # config change that the runtime only re-reads at boot (e.g.: MCP instances are
@@ -233,11 +278,15 @@ module Studio
         r.is do
           r.get do
             @agents = insika[:profile_source].all.sort_by(&:id)
+            # WS7 scorecard: the LAST outcome per agent, computed once for the
+            # whole grid (a store scan per card would be n scans). Series live
+            # on the agent detail — one agent's periods, not n charts here.
+            @latest_outcomes = insika[:outcome_store]&.latest_per_agent
             view("agents")
           end
 
           # POST /studio/agents — creates an agent ("everyone creates
-          # their own BIA"). Fires :create_agent; redirects to the new one's detail.
+          # their own agent"). Fires :create_agent; redirects to the new one's detail.
           r.post do
             check_csrf!
             id = presence(r.params["id"])
@@ -269,20 +318,86 @@ module Studio
             with_flash("Configuration saved.") do
               dispatch(:update_agent, config_patch(r))
             end
-            r.redirect(agent_path(id))
+            group = CONFIG_SECTIONS.include?(r.params["cfg"]) ? r.params["cfg"] : "model"
+            r.redirect(agent_path(id, "config", "cfg=#{group}"))
+          end
+
+          # Automatic-loop triggers, per agent. The loops (distillation,
+          # harvest, follow-up firing, funnel fold) already run on their own
+          # worker fibers when the agent declares them; these buttons exist so
+          # an operator can ask for a pass NOW, without waiting for the
+          # window. All three dispatch bus commands — the Studio never runs a
+          # loop itself.
+          r.post "distill" do
+            check_csrf!
+            done = 0
+            skipped = 0
+            begin
+              due_distill_sessions(id).each do |sid|
+                result = dispatch(:run_distillation, { session_id: sid })
+                if result && result[:distilled]
+                  done += 1
+                else
+                  skipped += 1
+                end
+              end
+              flash["notice"] = "Distilled #{done} session(s)" + (skipped.positive? ? " (#{skipped} skipped)." : ".")
+            rescue Insika::ValidationError, Insika::NotFoundError => e
+              flash["error"] = e.message
+            end
+            r.redirect(agent_path(id, "loops"))
+          end
+
+          r.post "harvest" do
+            check_csrf!
+            begin
+              result = dispatch(:run_harvest, { agent: id })
+              if result && result[:mined]
+                flash["notice"] = "Harvest run finished — #{result[:candidates]} candidate(s) mined."
+              elsif result && result[:skipped]
+                flash["notice"] = "Nothing mined — #{result[:skipped]}."
+              else
+                flash["notice"] = "Harvest run finished."
+              end
+            rescue Insika::ValidationError, Insika::NotFoundError => e
+              flash["error"] = e.message
+            end
+            r.redirect(agent_path(id, "loops"))
+          end
+
+          r.post "refinement" do
+            check_csrf!
+            with_flash("Refinement run finished — see the Refinement page.") do
+              dispatch(:run_refinement, { agent: id })
+            end
+            r.redirect(agent_path(id, "loops"))
           end
 
           # Store-backed prompts. Writing also ensures the file
           # enters `prompt_files` — otherwise the Prompt provider wouldn't load it.
           # prompt_files is synced by the Commands themselves (write/delete
           # register/remove the file) — the Studio just dispatches the operation.
+          #
+          # The prompts section renders as a drill (master file list | editor), so
+          # the file under edit rides the URL like skills does: GET .../prompts/:file
+          # opens that file, .../prompts/new opens the create form.
           r.on "prompts" do
+            r.get "new" do
+              @prompt_selected = ""
+              render_agent_detail
+            end
+
+            r.get String do |file|
+              @prompt_selected = utf8(file)
+              render_agent_detail
+            end
+
             r.post "delete" do
               check_csrf!
               with_flash("Prompt removed.") do
                 dispatch(:delete_agent_file, { agent_id: id, file: presence(r.params["file"]) })
               end
-              r.redirect(agent_path(id))
+              r.redirect(agent_path(id, "prompts"))
             end
 
             r.post "restore" do
@@ -293,7 +408,7 @@ module Studio
                            version: r.params["version"]
                          })
               end
-              r.redirect(agent_path(id))
+              r.redirect(prompt_edit_path(id, r.params["file"]))
             end
 
             r.post do
@@ -303,7 +418,7 @@ module Studio
                            agent_id: id, file: presence(r.params["file"]), content: r.params["content"].to_s
                          })
               end
-              r.redirect(agent_path(id))
+              r.redirect(prompt_edit_path(id, r.params["file"]))
             end
           end
 
@@ -358,7 +473,7 @@ module Studio
 
           # Agent memory. Scoped by tenant = agent id — the
           # SAME tenant the playground uses when chatting, so what is edited
-          # here is what the BIA reads on the turn. Each agent, its own memory.
+          # here is what the agent reads on the turn. Each agent, its own memory.
           r.on "memory" do
             r.post "fact" do
               check_csrf!
@@ -674,11 +789,90 @@ module Studio
                            .group_by { |t| t["turn"] }
             # Context breakdown per turn: chronological entries.
             @context_traces = insika[:context_trace_store]&.for_session(sid) || []
+            # the stage history — the session's outcomes folded
+            # into the agent's declared stages (unmapped kinds render raw).
+            @stage_history = stage_history_for(sid)
             view("session")
           end
         end
       end
 
+      # --- Customers: the memory drill  ----------------
+      # Derived from the store, not a registry: the index enumerates memory
+      # cells and classifies them by shape (D6). Every mutation dispatches a
+      # Command on the bus — the transport's constitutional rule (app.rb:21).
+      # The cell scope in the URL is parsed back into the (tenant, customer)
+      # pair: a "memory:acme:c-1" URL must edit the SAME cell the turn reads
+      # (E1 live) — passing the raw scope as `tenant` would double-prefix it.
+      r.on "customers" do
+        r.is do
+          r.get { render_customers }
+        end
+
+        r.on String do |raw_scope|
+          # Roda captures the segment URL-encoded; a customer cell contains
+          # colons (memory:acme:c-1), so decode before parsing.
+          scope = Rack::Utils.unescape_path(utf8(raw_scope))
+          cell = Insika::MemoryStore.parse_cell(scope)
+
+          r.get { render_customer(scope, cell) }
+
+          # Add/edit a fact inline (upsert) — the operator's stamp + audit.
+          r.post "fact" do
+            check_csrf!
+            with_flash("Fact saved.") do
+              dispatch(:memory_put_fact, {
+                         tenant: cell[:tenant], customer: cell[:customer],
+                         key: presence(r.params["key"]), value: r.params["value"].to_s,
+                         expires_at: presence(r.params["expires_at"]), operator: "studio"
+                       })
+            end
+            r.redirect(customer_path(scope))
+          end
+
+          r.post "forget-fact" do
+            check_csrf!
+            with_flash("Fact forgotten.") do
+              dispatch(:memory_forget_fact, {
+                         tenant: cell[:tenant], customer: cell[:customer],
+                         key: presence(r.params["key"]), operator: "studio"
+                       })
+            end
+            r.redirect(customer_path(scope))
+          end
+
+          # The LGPD access right: JSON download of the cell's content (D7 —
+          # the RETURN value is the download; the event stays counts-only). A
+          # cell with no customer (a _default cell, reachable by URL) is a
+          # ValidationError -> red flash, never a 500.
+          r.post "export" do
+            check_csrf!
+            result = dispatch(:export_customer_memory, {
+                                tenant: cell[:tenant], customer: cell[:customer],
+                                operator: "studio"
+                              })
+            response["content-type"] = "application/json"
+            response["content-disposition"] =
+              %(attachment; filename="memory-#{Rack::Utils.escape_path(scope.tr(':', '-'))}.json")
+            JSON.pretty_generate(result)
+          rescue Insika::ValidationError => e
+            flash["error"] = e.message
+            r.redirect(customer_path(scope))
+          end
+
+          # The LGPD forget — purges the cell AND the customer's sessions.
+          r.post "forget" do
+            check_csrf!
+            with_flash("Customer forgotten.") do
+              dispatch(:forget_customer, {
+                         tenant: cell[:tenant], customer: cell[:customer], operator: "studio"
+                       })
+            end
+            r.redirect("/studio/customers")
+          end
+        end
+      end
+
       # Tasks: list + detail + operator controls -------
       # Parity with server/admin: READS the task/checkpoint/pending stores to
       # render; pause/resume/cancel dispatch Commands on the bus (never a direct
@@ -803,6 +997,156 @@ end
         end
       end
 
+      # --- Harvest: the gated skill loop  ----------------------
+      # Reads the HarvestStore directly (the Studio's constitutional split);
+      # every mutation — mine now, gate, promote, reject, rollback — dispatches
+      # a bus command. The gate POST is slow on purpose: it replays the golden
+      # set, like Refinement's propose button.
+      r.on "harvest" do
+        r.is do
+          r.get { render_harvest }
+          r.post do # mine now (manual trigger, D10)
+            check_csrf!
+            agent = presence(r.params["agent"])
+            payload = { agent: agent, full: r.params["full"] == "1" }
+            control_action(:run_harvest, payload, ok: "Harvest run finished.")
+            r.redirect("/studio/harvest?agent=#{Rack::Utils.escape(agent.to_s)}")
+          end
+        end
+
+        r.post "gate" do # the double gate on one candidate (slow — replay)
+          check_csrf!
+          agent = presence(r.params["agent"])
+          payload = { candidate_id: presence(r.params["candidate_id"]) }
+          control_action(:gate_harvest, payload, ok: "Gated — see the verdicts below.")
+          r.redirect("/studio/harvest?agent=#{Rack::Utils.escape(agent.to_s)}")
+        end
+
+        r.post "promote" do
+          check_csrf!
+          agent = presence(r.params["agent"])
+          payload = { candidate_id: presence(r.params["candidate_id"]),
+                      operator: "studio", note: presence(r.params["note"]) }.compact
+          control_action(:promote_harvest, payload,
+                         ok: "Promoted — the skill is live for this store.")
+          r.redirect("/studio/harvest?agent=#{Rack::Utils.escape(agent.to_s)}")
+        end
+
+        r.post "reject" do
+          check_csrf!
+          agent = presence(r.params["agent"])
+          payload = { candidate_id: presence(r.params["candidate_id"]),
+                      operator: "studio", note: presence(r.params["note"]) }.compact
+          control_action(:reject_harvest, payload, ok: "Skill rejected.")
+          r.redirect("/studio/harvest?agent=#{Rack::Utils.escape(agent.to_s)}")
+        end
+
+        r.post "rollback" do
+          check_csrf!
+          agent = presence(r.params["agent"])
+          payload = { snapshot_ref: presence(r.params["snapshot_ref"]),
+                      operator: "studio", reason: presence(r.params["reason"]) }.compact
+          control_action(:rollback_harvest, payload, ok: "Rolled back to the snapshot.")
+          r.redirect("/studio/harvest?agent=#{Rack::Utils.escape(agent.to_s)}")
+        end
+      end
+
+      # --- Facts: the human gate on distilled proposals  --------
+      # Reads ProposalStore directly (the Studio's constitutional split — reads
+      # hit the stores, mutations go through the bus); the ONLY mutation — the
+      # approve/reject/dismiss answer — dispatches :resolve_proposal.
+      r.on "facts" do
+        r.get { render_facts }
+        r.post "resolve" do
+          check_csrf!
+          decision = presence(r.params["decision"])
+          ok = { "approved" => "Fact saved to memory.", "rejected" => "Proposal rejected.",
+                 "dismissed" => "Proposal dismissed — it will not be proposed again." }[decision]
+          with_flash(ok || "Proposal resolved.") do
+            dispatch(:resolve_proposal, { proposal_id: presence(r.params["proposal_id"]),
+                                          decision: decision, note: presence(r.params["note"]),
+                                          operator: "studio" })
+          end
+          filter = presence(r.params["filter"])
+          r.redirect("/studio/facts#{filter ? "?store=#{Rack::Utils.escape(filter)}" : ""}")
+        end
+      end
+
+      # --- Parity: the running shadow verdict  -----------------
+      # Reads stores and folds the verdict on demand; the judge button is a slow
+      # synchronous POST, exactly like Refinement's gate, for the same reason: it
+      # returns when the answer is real. There is deliberately no "freeze the
+      # criterion" button — freezing is a git commit, reviewed by a human.
+      r.on "parity" do
+        r.is do
+          r.get { render_parity }
+          r.post do
+            check_csrf!
+            agent = presence(r.params["agent"])
+            limit = presence(r.params["limit"]).to_i
+            payload = { agent: agent }.compact
+            payload[:limit] = limit if limit.positive?
+            control_action(:judge_shadow_pairs, payload,
+                           ok: "Judged — the verdict below is recomputed.")
+            r.redirect("/studio/parity?agent=#{Rack::Utils.escape(agent.to_s)}")
+          end
+        end
+      end
+
+      # --- Funnel: the outcome funnel per store  ----------------
+      # Reads the fold's cells + the BudgetLedger's current counters directly
+      # (D7 — the scorecard's constitutional split); the ONE mutation — the
+      # baseline freeze — dispatches :freeze_funnel_baseline on the bus.
+      r.on "funnel" do
+        r.get { render_funnel }
+        r.on String do |agent_id|
+          agent_id = utf8(agent_id)
+          r.post "freeze" do
+            check_csrf!
+            with_flash("Baseline frozen.") do
+              dispatch(:freeze_funnel_baseline,
+                       { agent: agent_id,
+                         from: presence(r.params["from"]),
+                         to: presence(r.params["to"]),
+                         # the card's hidden tenant field: WITHOUT it, a
+                         # multi-tenant deployment freezes the "platform" pair
+                         # while the operator believes they froze the store's.
+                         tenant: presence(r.params["tenant"]),
+                         operator: "studio" })
+            end
+            r.redirect("/studio/funnel")
+          end
+        end
+      end
+
+      # --- Follow-ups: the schedule records + the A/B readout  --
+      # Reads FollowupStore/ContactStore/OutcomeStore directly (D10 — the
+      # Studio's constitutional split); the ONLY mutations — cancel a pending
+      # record, force-revoke a contact (an opt-out event that never arrived) —
+      # dispatch bus commands.
+      r.on "followups" do
+        r.get { render_followups }
+        r.on String do |agent_id|
+          agent_id = utf8(agent_id)
+          r.post "cancel" do
+            check_csrf!
+            with_flash("Follow-up cancelled.") do
+              dispatch(:cancel_followup, { followup_id: r.params["id"] })
+            end
+            r.redirect("/studio/followups?agent=#{Rack::Utils.escape(agent_id)}")
+          end
+          r.post "revoke" do
+            check_csrf!
+            with_flash("Contact revoked — every pending follow-up cancelled.") do
+              dispatch(:revoke_contact,
+                       { customer: r.params["customer"], operator: "studio" },
+                       tenant: presence(r.params["tenant"]))
+            end
+            r.redirect("/studio/followups?agent=#{Rack::Utils.escape(agent_id)}")
+          end
+        end
+      end
+
       # Playground: sends `send_message` (the SAME Command as the API) and streams the
       # response live through the `live-transcript` island (SSE from /studio/events).
       r.on "playground" do
@@ -810,6 +1154,14 @@ end
           @agent = presence(r.params["agent"]) || default_agent
           @session_id = presence(r.params["session_id"])
           @agents = insika[:profile_source].ids.sort
+          # Session combobox: recent conversations as <datalist> suggestions for the
+          # session field. The open session always appears, even if it fell off the
+          # recent list (it is the one being edited).
+          @recent = recent_sessions(limit: 8)
+          if @session_id && @recent.none? { |s| s.id == @session_id }
+            current = insika[:session_store]&.find(@session_id)
+            @recent.unshift(current) if current
+          end
           # Server-side echo + continuity: render the session's persisted
           # transcript as bubbles. The user's message is only persisted at the END
           # of the turn, so the just-sent message rides a one-shot flash bubble
@@ -876,12 +1228,24 @@ end
         ]],
         ["operate", [
           ["Chats", "/studio/chats", :chats],
+          ["Customers", "/studio/customers", :chats],
           ["Playground", "/studio/playground", :playground],
+          ["Funnel", "/studio/funnel", :funnel],
+          # the Follow-ups page — scheduled, fired, blocked and
+          # cancelled records per agent + the per-arm A/B readout card.
+          ["Follow-ups", "/studio/followups", :followups],
+          # the Facts (wiki) page — the human gate on distilled
+          # proposals (approve/reject/dismiss, the latch, the CAS re-present).
+          ["Facts", "/studio/facts", :facts],
+          # the Harvest page — the human gate on mined skills
+          # (gate, promote, reject, rollback; the append-only promotion log).
+          ["Harvest", "/studio/harvest", :harvest],
           ["Tasks", "/studio/tasks", :tasks],
           ["Approvals", "/studio/approvals", :approvals],
           ["Refinement", "/studio/refinement", :refinement],
           ["Evals", "/studio/evals", :evals]
-        ]]
+        ] + parity_nav_item
+        ]
       ]
     end
 
@@ -962,7 +1326,7 @@ end
 
     def default_agent
       ids = insika[:profile_source].ids
-      ids.include?("bia") ? "bia" : (ids.first || "bia")
+      ids.include?("demo") ? "demo" : (ids.first || "demo")
     end
 
     # --- Transcript display helpers (playground + session viewer) ------------
@@ -1049,6 +1413,7 @@ end
 
     def render_agent_detail
       id = @agent.id
+      @config_group = CONFIG_SECTIONS.include?(request.params["cfg"]) ? request.params["cfg"] : "model"
       store = insika[:agent_file_store]
       @prompt_files = Array(@agent.prompt_files).map do |name|
         {
@@ -1069,6 +1434,14 @@ end
       @facts = mem ? mem.facts(tenant: id) : []
       @notes = mem ? mem.notes(tenant: id, limit: 20) : []
       @recent_sessions = recent_sessions
+      # WS7: last outcome + per-day series for THIS agent. The grid already
+      # shows the last-outcome pill; the series is the period view.
+      outcomes = insika[:outcome_store]
+      @latest_outcome = outcomes&.latest_per_agent&.[](id)
+      @outcome_series = outcomes ? outcomes.series(agent: id) : {}
+      # the per-agent cache-hit series (nil store -> the view's
+      # empty state; same guard as the tool trace).
+      @cache_series = insika[:cache_series_store]&.for_agent(id) || []
       view("agent_detail")
     end
 
@@ -1080,6 +1453,93 @@ end
       params[key.to_s].nil? ? "" : params[key.to_s]
     end
 
+    # A free-form config block (string-keyed by AgentProfile.build) rendered
+    # as the JSON textarea the form parses back. Pretty-printed so an operator
+    # actually reads the current state; "" when the block is absent.
+    def agent_json(config)
+      return "" if config.nil? || config.empty?
+
+      JSON.pretty_generate(config)
+    rescue StandardError
+      config.to_s
+    end
+
+    # A list field as comma-joined text for the form's textarea.
+    def agent_list(list)
+      Array(list).join(", ")
+    end
+
+    # A list field as newline-joined lines for the form's textarea.
+    def agent_lines(list)
+      Array(list).join("\n")
+    end
+
+    # The shared "filter by agent" GET form used by every shared screen
+    # (home, chats, tasks, approvals, customers, evals, funnel, follow-ups,
+    # facts, parity). Same markup everywhere: a select that submits on change.
+    def agent_filter_form(path, current)
+      ids = insika[:profile_source].ids.sort
+      options = [["", "all"]] + ids.map { |id| [id, id] }
+      rows = options.map do |value, label|
+        %(<option value="#{value}"#{' selected' if value.to_s == current.to_s}>#{label}</option>)
+      end.join
+      %(<form method="get" action="#{path}" class="actions inline"><label>Agent <select name="agent" onchange="this.form.submit()">#{rows}</select></label></form>)
+    end
+
+    # The sessions of one agent — the session stamps its agent in
+    # `vars["agent"]`, so any list of sessions is filterable by agent.
+    def agent_sessions(sessions, agent)
+      return sessions if agent.nil? || agent.empty?
+
+      sessions.select { |s| session_agent(s) == agent }
+    end
+
+    def session_agent(session)
+      vars = session.respond_to?(:vars) ? session.vars : nil
+      vars.is_a?(Hash) ? vars["agent"].to_s : ""
+    end
+
+    # The distill button's scope (the DistillEngine's own scan, scoped to ONE
+    # agent): the agent's sessions that are idle past the pack's window, long
+    # enough, and not yet distilled. Oldest first, capped — each entry is a
+    # provider call, so one click stays bounded. Reads hit the stores; the
+    # writes go through :run_distillation on the bus.
+    def due_distill_sessions(agent_id, limit: 5)
+      store = insika[:session_store]
+      proposals = insika[:proposal_store]
+      profile = insika[:profile_source].fetch(agent_id)
+      return [] if profile.nil? || store.nil? || proposals.nil?
+
+      config = Insika::Coercion.deep_stringify(profile.distill) || {}
+      idle_hours = positive_int(config["idle_hours"]) || 6
+      min_messages = positive_int(config["min_messages"]) || 3
+      cutoff = Time.now.utc - idle_hours * 3600
+      store.each_id.filter_map do |sid|
+        session = store.find(sid)
+        next unless session
+        next unless session.vars.is_a?(Hash) && session.vars["agent"] == agent_id
+        next if Insika::Coercion.blank?(session.vars["customer"])
+        next unless aged?(session.updated_at, cutoff)
+        next if session.messages.size < min_messages
+        next if proposals.distilled?(sid)
+
+        [sid, session.updated_at.to_s]
+      end.sort_by(&:last).map(&:first).first(limit)
+    end
+
+    def positive_int(value)
+      v = value.to_i
+      v.positive? ? v : nil
+    end
+
+    def aged?(updated_at, cutoff)
+      return false if Insika::Coercion.blank?(updated_at)
+
+      Time.iso8601(updated_at.to_s) <= cutoff
+    rescue ArgumentError
+      false
+    end
+
     # Renders the reasoning <select> shared by the agent config, settings and
     # playground (4-layer). `blank_label` names the empty option — the
     # "inherit the broader layer" / provider-default choice. Values come from a
@@ -1364,9 +1824,12 @@ end
     # At-a-glance dashboard: counts + activity + recent conversations. All from
     # data the Studio already reads (one scan of the session store); no new
     # metrics pipeline. `active_now` = sessions touched in the last 5 minutes.
+    # `?agent=` narrows every number to one agent (the sessions stamp their
+    # author in `vars["agent"]`).
     def render_home
       ps = insika[:profile_source]
-      sessions = all_sessions
+      @agent = presence(request.params["agent"])
+      sessions = agent_sessions(all_sessions, @agent)
       @counts = {
         "conversations" => sessions.size,
         "messages" => sessions.sum { |s| Array(s.messages).size },
@@ -1446,6 +1909,10 @@ end
 
     # --- Settings + LLM providers ----------------------------------
 
+    # The agent config tab's groups, in sidebar order. The view renders the
+    # same keys; a bogus ?cfg= falls back to the first group.
+    CONFIG_SECTIONS = %w[model guardrails grounding funnel followups distill harvest refinement budget_rel routing advanced].freeze
+
     SETTINGS_SECTIONS = %w[general models edge evals llm].freeze
     def render_settings
       store = insika[:settings_store]
@@ -1483,20 +1950,67 @@ end
     # --- Chats -----------------------------------------------------
 
     def render_chats
-      @sessions = recent_sessions(limit: 100)
+      @agent = presence(request.params["agent"])
+      @sessions = agent_sessions(recent_sessions(limit: 100), @agent)
       view("chats")
     end
 
+    # --- Customers  ----------------------------------
+
+    # The index: every CUSTOMER memory cell, grouped by tenant. The caller
+    # passes `reserved:` (profile ids + _default) so the agent-memory tab's
+    # cells and the shared cell stay out of the drill (D6 — the store is
+    # policy-free). Fact count per cell via a keys-only list (no payload
+    # reads per conversation on every render).
+    def render_customers
+      mem = insika[:memory_store]
+      agent_ids = insika[:profile_source] ? insika[:profile_source].all.map(&:id) : []
+      @agent = presence(request.params["agent"])
+      @rows = mem ? mem.customer_cells(reserved: Array(agent_ids) + ["_default"]).map do |cell|
+        { cell: cell, count: mem.fact_count(tenant: cell[:tenant], customer: cell[:customer]) }
+      end : []
+      # ?agent= narrows to one tenant — the memory scope is the agent (the
+      # agent-memory tab writes under tenant = agent id).
+      @rows = @rows.select { |row| row[:cell][:tenant] == @agent } if @agent
+      @by_tenant = @rows.group_by { |row| row[:cell][:tenant] }
+      view("customers")
+    end
+
+    # The detail: the parsed cell, its facts (expired excluded by C1), notes
+    # (append-only), and the operator audit (digests + counts, never content).
+    def render_customer(scope, cell)
+      @cell = cell
+      mem = insika[:memory_store]
+      @facts = mem ? mem.facts(tenant: cell[:tenant], customer: cell[:customer]) : []
+      @notes = mem ? mem.notes(tenant: cell[:tenant], customer: cell[:customer], limit: 50) : []
+      @audit = insika[:memory_audit_store]&.for_cell(scope) || []
+      view("customer")
+    end
+
+    def customer_path(scope)
+      # escape_path, not escape: the route decodes with unescape_path, which
+      # does not turn '+' back into a space (escape's form-encoding would).
+      "/studio/customers/#{Rack::Utils.escape_path(scope)}"
+    end
+
     # Tasks & Approvals --------------------------------
 
     # Task list, most-recently-updated first. Empty-state if no store was injected.
+    # `?agent=` narrows to one agent (the task's command payload stamps it).
     def render_tasks
       store = insika[:task_store]
+      @agent = presence(request.params["agent"])
       @tasks = store ? store.each_id.filter_map { |id| store.find(id) } : []
+      @tasks = @tasks.select { |t| task_agent(t) == @agent } if @agent
       @tasks = @tasks.sort_by { |t| t.updated_at.to_s }.reverse
       view("tasks")
     end
 
+    def task_agent(task)
+      command = task.command
+      command.is_a?(Hash) ? command.dig("payload", "agent").to_s : ""
+    end
+
     # Task detail: @task is set by the route. Adds the open approvals for this task
     # and its latest checkpoint (both degrade to empty when the store is absent).
     def render_task_detail(id)
@@ -1506,11 +2020,16 @@ end
     end
 
     # Approvals inbox: every :pending action across tasks, each paired with its
-    # task (for the status pill + a link into the task detail).
+    # task (for the status pill + a link into the task detail). `?agent=`
+    # narrows to one agent (via the owning task).
     def render_approvals
       pstore = insika[:pending_action_store]
       tstore = insika[:task_store]
+      @agent = presence(request.params["agent"])
       @approvals = pstore ? pstore.all_open.map { |pa| { pending: pa, task: tstore&.find(pa.task_id) } } : []
+      if @agent
+        @approvals = @approvals.select { |a| task_agent(a[:task]) == @agent if a[:task] }
+      end
       view("approvals")
     end
 
@@ -1523,6 +2042,8 @@ def render_evals
   store = insika[:golden_store]
   @cases = store ? store.all : []
   @invalid = store ? store.invalid : []
+  @filter = presence(request.params["agent"])
+  @cases = @cases.select { |g| g.agent == @filter } if @filter
   @by_agent = @cases.group_by(&:agent).sort.to_h
   wanted = presence(request.params["id"])
   @case = wanted && @cases.find { |g| g.id == wanted }
@@ -1556,6 +2077,331 @@ end
       view("refinement")
     end
 
+    # --- Parity  -------------------------------------------------
+
+    # The nav row exists ONLY when a shadow channel is registered — the page is
+    # not an invitation, unlike Refinement's.
+    def parity_nav_item
+      shadow_channel? ? [["Parity", "/studio/parity", :parity]] : []
+    end
+
+    def shadow_channel?
+      registry = insika[:channel_registry]
+      return false unless registry
+
+      Array(registry.names).any? do |name|
+        channel = registry.find(name)
+        channel.respond_to?(:shadow?) && channel.shadow?
+      end
+    end
+
+    def parity_pairs
+      insika[:shadow_pair_store] ? insika[:shadow_pair_store].each.to_a : []
+    end
+
+    def render_parity
+      @criterion = insika[:parity_criterion]
+      @agent = presence(request.params["agent"])
+      # ONE materialization per request: the fold and the pair list share this
+      # array (the store's counts would scan the whole table a second time).
+      pairs = parity_pairs
+      pairs = pairs.select { |p| p.agent.to_s == @agent } if @agent
+      @report = @criterion && Insika::Parity::Verdict.fold(pairs: pairs, criterion: @criterion)
+      @pairs = pairs.sort_by { |p| p.created_at.to_s }.reverse.first(50)
+      @pending = pairs.count { |p| p.status == :complete }
+      if @criterion
+        @judge_cost = @pending * @criterion.rule.min_judge_models * 2
+        @judge_models = ((insika[:settings_store]&.get || {})["evals"] || {})
+      end
+      # Judge agreement : split/unknown from the fold, plus how many
+      # verdicts flipped with presentation order.
+      @agreement = { order_dependent: pairs.count { |p| p.verdict.is_a?(Hash) && p.verdict["order_dependent"] } }
+      view("parity")
+    end
+
+    # --- Funnel  ------------------------------------------------
+
+    # One card per STORE (agent) that declares a funnel, each with a block per
+    # tenant that has folded cells. The only mutation on this page — the
+    # baseline freeze — dispatches :freeze_funnel_baseline (D7).
+    def render_funnel
+      profiles = insika[:profile_source]&.all || []
+      p = request.params["period"].to_i
+      @period = p.positive? ? p : 30
+      @agent = presence(request.params["agent"])
+      profiles = profiles.select { |p| p.id == @agent } if @agent
+      @stores = profiles.filter_map do |p|
+        decl = Insika::FunnelDeclaration.parse(p.funnel)
+        next unless decl
+
+        { profile: p, decl: decl, tenants: tenants_for(p.id) }
+      end
+      view("funnel")
+    end
+
+    # the Follow-ups page. Per agent WITH a parsed policy, one
+    # block: the pending/fired/cancelled/blocked lists (blocked rows carry the
+    # reason pill), the per-arm counts, the read-only policy summary and the
+    # A/B card (D10 — reads stores, mutates through bus commands only).
+    def render_followups
+      profiles = insika[:profile_source]&.all || []
+      @agent = presence(request.params["agent"])
+      profiles = profiles.select { |p| p.id == @agent } if @agent
+      @stores = profiles.filter_map do |p|
+        decl = Insika::FollowupPolicy.parse(p.followup)
+        next unless decl
+
+        {
+          profile: p, policy: decl,
+          tenant: presence(request.params["tenant"]) || "platform",
+          records: followup_records(p.id, decl),
+          ab: followup_ab(p.id, decl)
+        }
+      end
+      @has_followups = !@stores.empty?
+      view("followups")
+    end
+
+    # the Facts (wiki) page — the human gate on distilled
+    # proposals. Reads ProposalStore + SessionStore directly (D7 — evidence is
+    # a link, never a copy: the excerpt is read from the session at request
+    # time); the mutations dispatch :resolve_proposal on the bus.
+    def render_facts
+      store = insika[:proposal_store]
+      @pending = store ? store.pending(limit: 100) : []
+      @stale   = store ? store.stale(limit: 50) : []
+      @recent  = store ? store.resolved(limit: 20) : []
+      # `?agent=` filters by the proposal's AGENT (the origin session's
+      # stamp); `?store=` keeps filtering by the memory-cell scope (the
+      # pre-review behavior). Both narrow the same three lists.
+      @filter = presence(request.params["agent"]) || presence(request.params["store"])
+      if @filter
+        @pending = @pending.select { |p| scope_matches?(p, @filter) }
+        @stale   = @stale.select { |p| scope_matches?(p, @filter) }
+        @recent  = @recent.select { |p| scope_matches?(p, @filter) }
+      end
+      # The select: the filtered agents (profile ids) PLUS every scope a
+      # proposal ever carried, so an agent with proposals and one without can
+      # both be picked.
+      @stores  = (insika[:profile_source].ids.sort +
+                  (@pending + @stale + @recent).map(&:scope)).uniq.sort
+      @sessions = insika[:session_store]
+      view("facts")
+    end
+
+    # A proposal matches the filter as the memory scope it carries, or as the
+    # agent of the session it came from (when the session is still around).
+    def scope_matches?(proposal, filter)
+      return true if proposal.scope == filter
+
+      session = insika[:session_store]&.find(proposal.session_ref)
+      session && session_agent(session) == filter
+    end
+
+    # the Harvest page — the human gate on mined skills. Reads
+    # HarvestStore/SessionStore directly (the evidence excerpt is read from the
+    # session at request time — D7: ids and indexes only are stored); every
+    # mutation dispatches a bus command.
+    def render_harvest
+      @agents = insika[:profile_source].ids.sort
+      @agent = presence(request.params["agent"]) || @agents.first
+      store = insika[:harvest_store]
+      # EVERY list respects the agent filter (the review fix) — the page is a
+      # per-store inbox, not a global one.
+      @candidates = @agent && store ? store.candidates(agent_id: @agent, status: "awaiting_approval") : []
+      @pending_gates = @agent && store ? store.candidates(agent_id: @agent, status: "pending").first(50) : []
+      @blocked = if @agent && store
+                   store.candidates(agent_id: @agent, status: "gated")
+                        .select { |c| !c.eval_gate || !c.conversion_gate || c.conversion_gate["passed"] == false }
+                        .first(50)
+                 else
+                   []
+                 end
+      @recent = @agent && store ? store.candidates(agent_id: @agent, status: "promoted").first(20) : []
+      @runs = @agent && store ? store.runs_for(@agent, limit: 5) : []
+      @promotions = @agent && store ? store.promotions(agent_id: @agent, limit: 50) : []
+      @criterion = insika[:harvest_criterion]
+      @funnel = insika[:funnel_store]
+      @sessions = insika[:session_store]
+      @negative = insika[:negative_list]
+      @filter = presence(request.params["agent"])
+      view("harvest")
+    end
+
+    # The evidence excerpt for a candidate — the origin sessions' messages at
+    # the stored indexes, read at request time (D7: ids and indexes only).
+    #
+    # An index is validated by the miner as "fits at least one origin
+    # session", so it must NOT be rendered against every origin session — the
+    # same index would point at different conversations (the review fix).
+    # Each index renders ONE message, from the first origin session where it
+    # is in range, labeled with that session.
+    def candidate_excerpt(candidate)
+      Array(candidate.evidence_turns).filter_map do |i|
+        session = Array(candidate.origin).filter_map { |sid| @sessions&.find(sid) }
+                                          .find { |s| s.messages && s.messages[i] }
+        next unless session
+
+        [session.id, i, session.messages[i]["content"].to_s]
+      end
+    end
+
+    # The negative list's rejection counts per rule, read from the RUN
+    # records (D4 — the counts the Studio shows are what the engine logged:
+    # the run carries { rule_id => count, "ungrounded" => N, ... }).
+    def negative_rule_counts
+      store = insika[:harvest_store]
+      return {} unless store
+
+      store.runs_for(@agent || "", limit: 200).each_with_object(Hash.new(0)) do |run, acc|
+        Array(run.rejected).each { |rule, n| acc[rule] += n.to_i }
+      end
+    end
+
+    # The excerpt for a proposal's evidence — the transcript messages at the
+    # stored indexes, read at request time (D7: ids and indexes only are
+    # stored). Deep-links to the existing session page.
+    def proposal_excerpt(proposal)
+      session = @sessions&.find(proposal.session_ref)
+      return [] unless session && session.messages
+
+      Array(proposal.evidence).filter_map do |i|
+        session.messages[i] && session.messages[i]["content"].to_s
+      end
+    end
+
+    # The agent's records across every status (a nil store reads as none).
+    def followup_records(agent_id, _decl)
+      store = insika[:followup_store]
+      return [] unless store
+
+      store.for_agent(tenant: presence(request.params["tenant"]) || "platform",
+                      agent: agent_id)
+    end
+
+    # The A/B readout per arm (D3 — a read-only fold over the same records):
+    #   sent         = fired count in the period;
+    #   conversions  = outcome records whose session_id is a fired record's
+    #                  session (primary-filtered by the   declaration
+    #                  when one exists, else the first outcome per session);
+    #   opt-outs     = contact cells flipped :revoked after a fired_at.
+    # The note anchors the ruler outside the card: the A/B is the operator's;
+    # this card reads the   baseline.
+    def followup_ab(agent_id, _decl)
+      store = insika[:followup_store]
+      return {} unless store
+
+      from = (Time.now.utc - 30 * 86_400).iso8601
+      fired = store.for_agent(tenant: presence(request.params["tenant"]) || "platform",
+                              agent: agent_id)
+                .select { |r| r.status == "fired" && r.at.to_s >= from }
+      fired.group_by(&:arm).each_with_object({}) do |(arm, records), acc|
+        sessions = records.filter_map(&:session_id)
+        acc[arm] = { sent: records.size, conversions: conversions_for(agent_id, sessions),
+                     opt_outs: opt_outs_since(records) }
+      end
+    end
+
+    # The conversions of the arm's fired sessions. Primary-filtered by the
+    #   funnel declaration when the agent declares one; else the FIRST
+    # outcome per session (an outcome record is one vote per session).
+    def conversions_for(agent_id, sessions)
+      outcomes = insika[:outcome_store]
+      return 0 unless outcomes
+
+      records = sessions.empty? ? [] : outcomes.all.select { |r| sessions.include?(r.session_id) }
+      primary = primary_stage_for(agent_id)
+      return records.count { |r| r.outcome == primary } if primary
+
+      records.group_by(&:session_id).size
+    end
+
+    def primary_stage_for(agent_id)
+      profile = insika[:profile_source]&.fetch(agent_id)
+      decl = profile && Insika::FunnelDeclaration.parse(profile.funnel)
+      decl && decl.primary
+    end
+
+    # The opt-outs of ONE arm: contact cells of the customers THAT ARM fired
+    # to (same tenant), flipped :revoked after that customer's own fire. Never
+    # a global revoked count — an unrelated opt-out (another tenant, another
+    # customer) must not count against an arm, or the H-followup kill decision
+    # reads strangers.
+    def opt_outs_since(records)
+      store = insika[:contact_store]
+      return 0 unless store
+
+      cells = store.cells
+      # group this arm's fires by (tenant, customer) -> the earliest fire
+      records.group_by { |r| [r.tenant, r.customer] }.sum do |(tenant, customer), recs|
+        fired_at = recs.filter_map { |r| parse_time(r.fired_at || r.at) }.min
+        next 0 if fired_at.nil?
+
+        cell = cells["#{tenant}:#{customer}"]
+        cell && cell["state"] == "revoked" && revoke_after?(cell, fired_at) ? 1 : 0
+      end
+    end
+
+    def revoke_after?(cell, fired_at)
+      updated = parse_time(cell["updated_at"])
+      updated && updated > fired_at
+    end
+
+    def parse_time(value)
+      Time.iso8601(value.to_s)
+    rescue ArgumentError
+      nil
+    end
+
+    # Tenant list per agent, derived from the store cells (D7, the 0031 drill
+    # pattern) — multi-tenant deployments show one card block per tenant; a
+    # single-tenant deployment just "platform".
+    def tenants_for(agent_id)
+      cells = insika[:funnel_store]&.pairs.to_a || []
+      cells.select { |c| c[:agent] == agent_id }.map { |c| c[:tenant] }
+    end
+
+    # Sums the folded counts over the period -> { stage => count } for the view.
+    # A nil store (base wiring) reads as all-zero — the page still renders the
+    # declaration and the freeze form.
+    def funnel_period_counts(store, tenant, agent, period)
+      return {} unless store
+
+      today = Date.today.iso8601
+      from = (Date.today - period).iso8601
+      store.days(tenant: tenant, agent: agent, from: from, to: today)
+           .each_with_object(Hash.new(0)) { |(_, counts), acc| counts.each { |s, n| acc[s] += n } }
+    end
+
+    # BudgetLedger's current counters (D6): "tokens today / this month". nil
+    # store -> the view renders 0 (the empty state).
+    def funnel_spend(store, tenant, agent)
+      return { daily: 0, monthly: 0 } unless store
+
+      store.current(tenant: tenant, agent: agent)
+    end
+
+    # the session's stage history — each outcome record of the
+    # session folded to its stage by the agent's declaration (unmapped kinds
+    # render the raw outcome with a muted note — the hole is visible).
+    # Without a declaration the block renders the raw outcomes.
+    def stage_history_for(sid)
+      records = Array(insika[:outcome_store]&.all&.select { |r| r.session_id == sid })
+                 .sort_by { |r| r.at.to_s }
+      return [] if records.empty?
+
+      agent = records.first.agent
+      profile = insika[:profile_source]&.fetch(agent)
+      decl = profile && Insika::FunnelDeclaration.parse(profile.funnel)
+      {
+        declaration: decl,
+        rows: records.map do |r|
+          stage = decl && decl.advance_on[r.outcome]
+          { outcome: r.outcome, stage: stage, at: r.at, value: r.value }
+        end
+      }
+    end
+
     # A run's window in words. An EMPTY window means "the collector's own default" —
     # resolve it for the operator instead of rendering a blank.
     def refinement_window(window)
@@ -1641,11 +2487,26 @@ end
       "/studio/playground?#{query}"
     end
 
-    def agent_path(id, anchor = nil)
+    def agent_path(id, anchor = nil, query = nil)
       base = "/studio/agents/#{Rack::Utils.escape(id)}"
+      base += "?#{query}" if query
       anchor ? "#{base}##{anchor}" : base
     end
 
+    # Deterministic avatar hue: the id's fingerprint, so agents/sessions are
+    # scannable at a glance (Linear-style). CSP forbids inline styles, so the
+    # hue is a class: avatar-h0..avatar-h9 in application.css.
+    def avatar_class(id)
+      "avatar-h#{id.to_s.bytes.sum % 10}"
+    end
+
+    # Where a prompt POST lands back: the same file open in the drill, scrolled
+    # to the prompts section. No file (a delete, say) → the agent page itself.
+    def prompt_edit_path(id, file)
+      name = presence(file)
+      name ? "#{agent_path(id)}/prompts/#{Rack::Utils.escape(name)}#prompts" : agent_path(id, "prompts")
+    end
+
     # Serves a versioned asset from dist. `File.basename` kills path traversal; only
     # files that exist in the dist dir are served.
     def serve_asset(name)