insika 0.8.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 345e57c18a277e8ecd49b2481300c1474c60b2e0c3c384a086740e0de5ec3a2e
-  data.tar.gz: 800794431e279fec34f135e4e203a0488b04066b667bc691806ea5f575d81530
+  metadata.gz: b98a9d84df7cda373881cc11d0658bc3dd208ceb4bc52c23ed4fed4bd641fbb4
+  data.tar.gz: cecc0e4671a335efc5670f297aaf53ebafd5f1662f25a3121894825582494b30
 SHA512:
-  metadata.gz: 199cc16b9ea651ec2da1d2e6f7ddea5020194882da00cf96981e8d5d44086233862873d14640d11cd1d445f9d202992ed46691210f9fb1699b1a3d56a99b3145
-  data.tar.gz: 44d24bc53036da3803ee6eba6203d1addc8ccf0bd27c1aa15d1e9acfe763bca807ede55c2b7136ee2c245e5cd725541c719baa018c99e09638e964803bf688a9
+  metadata.gz: 332d1cea74cdbee9e3241dfefc73538824643fe3b65964fb2584ed57fb4d85c7b1cb547c7d2ccf3ff2acd4893d49063bed60fbf6e94ed6968e1c30bbd9671b30
+  data.tar.gz: d203a16b2954fb36829ed074a463ebac6dce26fea980e546debf5e908e4bf6bfb77c7d04b2e703816254022eaf3da9dbbce1a09c845525454dc6126996ce00b0

data/CHANGELOG.md

@@ -3,11 +3,321 @@
 All notable changes to this project are documented here.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the
-project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once
-it is released. Entries land with the pull request that makes the change.
+project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) from 1.0.0 on. Entries land with the pull request that makes the change.
 
 ## [Unreleased]
 
+## [1.0.1] - 2026-10-23
+
+### Removed
+
+- Internal planning notes (`docs/superpowers/`) are no longer in the repository or the
+  gem. 1.0.0 shipped them by mistake; the packaging now never ships that directory.
+
+## [1.0.0] - 2026-10-23
+
+### Added
+
+- Harvest page: each pending or blocked candidate shows its skill text, rationale and origin conversation; a blocked one can be re-gated once the missing piece is fixed; the page says when the loop skips an agent (harvest off, or no grounding matcher).
+- Studio screens for watching conversations and what waits on a person (see
+  [Studio](docs/STUDIO.md)):
+  - **Live** (`/studio/live`): one card per recent conversation, moved by the
+    event stream (tools in the running turn, "agent is writing…", guardrail
+    flags), with an event ticker. `?agent=` shows one agent's conversations.
+  - **Why this reply**: under each agent reply, its turn's context by category,
+    skills injected and why, tool calls with timing and guardrail flags, plus
+    Replay in Playground and Save as eval case.
+  - **Inbox** (`/studio/inbox`): approvals, fact proposals, mined skills,
+    refinement runs and guardrail false-positive reports in one list, oldest
+    first, with tabs per type.
+  - **Guardrail false positives**: a flag can be marked as a false positive,
+    then resolved or undone (`:review_guardrail_flag`). The verdict lives on the
+    flag inside the session.
+  - **Agent History**: outcomes per day over 30 days with a marker per change
+    to a prompt file or to the agent's own skills, and per change a short diff
+    and the outcomes 7 days after vs 7 days before.
+  - **Funnel drops**: the biggest loss between stages, and per loss the
+    conversations that stopped there, grouped by the last thing that happened.
+  - Chats tabs (All / Active now / Guardrail flagged), a customer card on the
+    session, a tool-call waterfall per turn, an Overview "Needs attention" row,
+    a `⌘K` palette, and a sidebar grouped as Operate / Review / Build /
+    Insights / Platform with a count badge on each Review page.
+  - Markup tags in message text (`<carrossel/>`, `<vitrine formato="lista">`)
+    show as highlighted tokens, escaped and never rendered.
+- `Store#amend(scope, key, value)`: overwrites a key without moving it in
+  `#recent`. The default is `#set`; a backend whose `#recent` follows its own
+  write order overrides both (the contract suite checks it). Memory, SQLite and
+  Postgres implement it.
+- Persisted turn messages and tool-call traces carry `task_id`, so the Studio
+  ties each message to its own turn.
+
+- `scripts/migrate_openclaw.rb seed`: carries recent OpenClaw conversations into
+  Insika sessions (`POST /v1/conversations/:id/seed`) so a returning customer
+  keeps the context. Reads root and per-process SQLite transcripts, follows the
+  active branch from the last compaction, keeps only customer text and agent
+  replies, and skips conversations that already have messages. `--only`/`--as`
+  rehearse one conversation on a test chat.
+  Each session is stamped with `--agent`, so the Studio lists it under that
+  agent; re-running stamps sessions seeded before (they still answer 409).
+- Platform agent defaults (Studio › Settings › Agent defaults, or
+  `update_settings` with `agent_defaults`): an agent with no value of its own
+  for reliability, knowledge, memory retrieval, budget, alerts, guardrails,
+  grounding, follow-ups, distillation or harvest runs with the platform's. The
+  agent's own value wins whole. Each of those sections in the agent config has
+  a "use the platform default" box; saving with it checked keeps the agent
+  inheriting. A default is validated on save, and one that stops building
+  later leaves agents on their own values instead of failing turns. Agents
+  saved in the Studio before this have their own knowledge, guardrails,
+  distillation and harvest values (the form always wrote them): check the box
+  to make them inherit.
+
+- **Optional Postgres store** (`INSIKA_DATABASE_URL`, `INSIKA_DATABASE_POOL`). It passes the
+  same store contract as SQLite; `pg` is not a gem dependency and loads only when the
+  variable is set. `scripts/store_copy.rb` moves an existing store. See
+  [Postgres store](docs/DEPLOY.md#postgres-store-optional) for when it pays off.
+- `Store#entries` and `Store#recent`: a whole scope, or its most recently written keys, in
+  one call. The default implementation keeps third-party backends working; SQLite and
+  Postgres answer each in one query. The Studio's session and task lists use them.
+- `INSIKA_SLOW_STORE_MS` also logs each slow write batch: its size, bytes, scopes, and how
+  long it waited for the lock versus how long its commit took.
+
+### Changed
+- Session stats are versioned (`"v" => 2`, adds the guardrail flagged and
+  reported counts). `scripts/backfill_session_stats.rb` now also rewrites stats
+  older than the current version, not only missing ones.
+- Reviewing a guardrail flag no longer moves the session to the top of the
+  recent lists.
+- **MCP tools are named after their instance**: `<instance>__<tool>` (e.g.
+  `shop_staging__list_products`). Two instances offering the same tool used to share
+  one name, and every call went to whichever instance came first. Agents that allowed
+  MCP tools by name must select them again; per-tool overrides keep the server's name.
+- `INSIKA_EGRESS_HOSTS` pins an MCP server only when its host resolves to a private
+  address. The operator registers the URL and the model cannot change it, so adding a
+  public server needs no redeploy. HTTPS still applies, and a private server still needs
+  `INSIKA_EGRESS_ALLOW_PRIVATE` and a listed host.
+
+- An input guardrail injection hit no longer replaces the turn with the canned
+  refusal by default. The message reaches the model with a per-turn
+  `<security_notice>` (never persisted) and an audit `guardrail_flagged` with
+  `action: "flag"`, so a legitimate request in the same message is still served.
+  Sexual and abuse hits still block, now also when the message carries an
+  injection too. `guardrails.injection: "block"` (Studio › Guardrails › on
+  injection) restores the old behavior.
+- `Store#recent` takes an optional fourth argument, `offset`, to read the next page; a
+  backend that implements the three-argument form keeps working (the stores pass
+  `offset` only when paging). SQLite reads a page's keys from the index and then only
+  their values, instead of reading every value in the range to sort it.
+- Studio: the tasks list shows 50 tasks per page, newest first, instead of every task.
+  The home reads only the sessions of the last 14 days; its messages card counts that
+  window (and says so), and the conversations total comes from the keys alone.
+- Every session write also writes a small stats record (last update, message count,
+  agent) in the `session_stats` scope, and the Studio home reads those instead of whole
+  sessions (every stat, filtered by date, so the order they were written in does not
+  matter). Sessions stored before this change have no stats until
+  `scripts/backfill_session_stats.rb` runs once (idempotent, safe with the app running;
+  it also removes stats whose session is gone).
+- RubyLLM is pinned to a newer `2.0.0` commit: streamed responses are priced once when
+  read instead of on every chunk, and HTTP connections are shared per process and
+  settings. Specs stub LLM HTTP with `stub_llm_http`, because swapping the adapter on an
+  already-built connection no longer takes effect.
+
+- Studio tools are grouped by origin and MCP server, with name/server filtering,
+  collapsible sections and per-section select/deselect actions. Selection keeps
+  denied tools blocked and requires saving before permissions change.
+
+- Workflow and tool argument validation now use JSONSchemer. Explicit nulls and
+  declared constraints are enforced; existing tool scalar leniency remains.
+- Distillation, harvest, knowledge and refinement use native structured responses.
+  Retired MCP import delegates to live discovery instead of generating HTTP snapshots.
+
+- RubyLLM 2 migration: native loop control, tool schemas, cache markers, and usage
+  readers. MCP now uses the native RubyLLM client, replacing `ruby_llm-mcp` and the
+  Origin-header patch. Legacy SSE requires migration to Streamable HTTP. See
+  [migration results](docs/RUBYLLM_2_MIGRATION.md).
+- Requires RubyLLM `~> 2.1` from RubyGems; the Git pin is gone. A provider's 400
+  quota message ("quota exceeded", "wait before trying again") now arrives as
+  `RubyLLM::RateLimitError` and is retried and rotated instead of failing the turn.
+
+- SQLite writes from concurrent turns share one transaction and one commit (group commit),
+  so N worker processes take the file's write lock far less often. A turn opens and
+  closes its task record in one write each, and skips an empty evidence write.
+- Litestream 0.5 with its blocking checkpoint disabled (`truncate-page-n: 0`); it restores
+  backups made by 0.3.
+- Less CPU per turn: the prompt reads an agent's files once per build, the prompt-echo
+  check caches each squeezed prompt, and streamed events are matched only against their
+  own session's subscriptions.
+
+### Removed
+
+- **The `HARNESS_*` environment variables (breaking).** Only the `INSIKA_*` names are
+  read. A leftover `HARNESS_*` key is no longer honored: it is reported as an error
+  naming its `INSIKA_*` replacement (a warning at boot, fatal under
+  `INSIKA_CONFIG_STRICT`, and an error in `insika doctor`), so a stale `HARNESS_DB`
+  cannot silently boot the engine on the memory backend. `EnvSchema.reconcile_legacy!`
+  is gone, and the bundled `insika-code` plugin and example read `INSIKA_CODE_*`.
+- **The `plugin.yml` manifest name (breaking).** Only `insika.plugin.yml` loads. A
+  leftover `plugin.yml` is not loaded and warns to rename it.
+- `Insika::LLMHTTPAdapter` (`faraday_adapter = :insika_net_http`). RubyLLM 2.1 shares
+  one connection per process and settings, so the stock `:net_http` no longer builds a
+  CA store per chat. A deployment that set `:insika_net_http` drops that line.
+
+### Fixed
+
+- Skills written in one worker (pack import, Studio edit, `write_skill`) now reach the other workers within 2 s. The catalog only reloaded in the worker that handled the write, so the others kept the skills they booted with until a restart — in the Studio and in customer turns.
+- Harvest no longer mines simulator/eval sessions (`sim-…`, `eval-…`), and the miner sees the candidates still open so it stops re-proposing the same idea under new names.
+- Harvest: a bare `miner.model` ref (no `provider/`) now uses the agent's provider; it used to fail every run with `Provider must be specified`.
+- Studio: `/studio` without a trailing slash answered 404; it now opens the
+  Overview.
+- Studio: the agent History chart and arm conversions counted outcome kinds
+  against the primary stage name, so they read 0 whenever the kind and stage
+  names differ; they now map kinds through `advance_on`.
+- Studio: a negative message or flag index on a guardrail review counted from
+  the end and reviewed the wrong flag; it is now not found.
+- An error that is fatal only for one model or account no longer kills the turn:
+  no balance (402), a bad key or missing access (401/403) and a model the provider
+  does not have (404) move straight to the next fallback node — no retry on that
+  node, no backoff, and no circuit-breaker count (an open primary circuit fails
+  fast without rotating). On the last node it still raises; a 400 still never
+  rotates.
+- Studio model fields are type-to-search pickers over the configured providers'
+  `provider/model` refs (their declared models, plus the chat models of key-only
+  providers): the agent model, a new agent, the playground pin and Settings'
+  default, fallback (one slot per position) and utility models. The server
+  refuses a ref outside the list — a typed `openai/gpt-x` under provider `openai`
+  used to reach the API as `openai/openai/gpt-x`. A stored value outside the list
+  is shown marked "not configured" and may be saved back unchanged. The plain
+  `model`/`provider` fields still pass as given for API clients.
+  The same pickers cover the reliability fallback chain (agent and Agent
+  defaults) and the refinement proposers, one slot per position, and the
+  knowledge, distill, harvest-miner and compaction models.
+- Data-tools imported or edited in one worker now reach the others: the tool
+  registry checks the config version token (at most every 2 s) and rebuilds when
+  it moved, and the tool catalog follows. Before, the other workers kept the
+  catalog they booted with until a restart.
+- LLM providers authored at runtime reach every worker process, and survive a
+  restart: each chat re-applies the stored providers when they changed. Before,
+  only the worker that served the edit had the key, so a fallback on that
+  provider failed as unconfigured. A cleared key stops being used; a key from
+  the environment is never cleared by it.
+- Deleting an LLM provider authored at runtime puts back the key and base the
+  process started with (for example from the environment) instead of leaving
+  the provider without credentials; a worker that never applied the provider
+  leaves its config alone. Delete no longer disables a provider that also has a
+  key from the environment.
+- Native chat usage includes tool rounds and retries, and failed turns expose
+  recorded usage. Responses projects cache-inclusive totals; negotiated pricing
+  no longer subtracts cache reads from already non-cached input.
+- Reliability honors session model pins and model allowlists without multiplying
+  its attempt budget by RubyLLM transport retries.
+- Speech response reads stop at the byte limit before buffering the entire body.
+- Workflow schemas accept valid `false` values.
+
+- **A merged fragment is framed by `steer_join`, like a steered one already was.** The
+  two burst doors disagreed on what the model sees: a steered message becomes its OWN
+  `user` message in the transcript (framed by `steer_join`), while a merged one was
+  concatenated into the queued turn's single payload by a bare `\n`. A burst therefore
+  reached the model as one run-on paragraph with no boundary between the asks, and a
+  trailing constraint could be answered by nothing (staging, Acme Beauty,
+  2026-09-18: five messages merged 4/4, and the answer never mentioned the fifth).
+  `steer_join` now applies to both doors; the default `nil` returns the text untouched,
+  so a wiring that never set it is unchanged.
+
+- **The door is open for as long as a turn is queued, not only during a debounce
+  window.** `collect`/`steer` merged a fragment only while a turn sat in a
+  `debounce_ms` window; a message that arrived while a turn waited behind the one in
+  flight joined nothing and became a turn of its own, third in line. A
+  `POST /v1/messages?stream=false` caller then held its connection through TWO turns
+  and timed out — on the WhatsApp integration that surfaced as a technical apology
+  to the customer, once per excess message of a burst. A queued turn is now mergeable
+  with or without a window, so every burst message answers immediately with `merged`
+  or `steered`. `followup` (the default) is untouched.
+- **Re-importing a pack no longer erases the knobs it did not send.** `limits` and
+  `params` now MERGE per key on an update (`PackImporter::KNOB_BAGS`); everything
+  else keeps replacing. A provisioning client that publishes
+  `limits: {turn_timeout:, context_budget:}` used to drop every other knob on the
+  agent — `queue_mode`, `debounce_ms`, `chat_rate_limit` — so an unrelated playbook
+  publish silently reset the queue policy an operator had set in the Studio. The
+  authoritative allowlists (`prompt_files`/`skills`/`tools_allow`) are unchanged: a
+  name that left the pack still leaves the agent.
+- One door per queued turn: with two turns waiting, the second used to take over the
+  first's fragment count, and the first then ran from a message snapshot the store had
+  already grown past.
+
+## [0.9.0] - 2026-09-07
+
+The commerce-agent wave: the engine now enforces what the prompt used to ask for —
+a write names only IDs a lookup returned, the model picks which cards to show and
+the engine shows them, third-party text can be fenced before the model reads it,
+and an eval case can start from a seeded snapshot. Additive on the wire: `/v1`
+gains frames and keys, none change meaning.
+
+### Added
+
+- **Write provenance** — `requires_evidence` on HTTP data tools checks declared
+  ID parameters against the session evidence ledger before approval or execution.
+  Unknown IDs and an unavailable ledger return `blocked` with gate `provenance`.
+  Studio editing, Doctor diagnostics, session traces, `tool_blocked`, the
+  `insika.tool.blocked` counter and `insika tools:report` expose the gate.
+  See [Tools](docs/TOOLS.md#provenance-checking-ids-before-a-write).
+- **Snapshot evals** — cases can seed evidence IDs, memory, user/assistant history
+  and briefing before the first turn. The authenticated seed endpoint is disabled
+  by default (`evals.seeding`); Doctor warns when enabled. New assertions cover
+  forbidden/alternative/first calls, call limits, reply text and blocked gates.
+  Responses SSE now carries tool arguments, completion status and the provider's
+  `call_id` on both item frames, so a consumer pairs `added` with `done`.
+  See [Evals](docs/EVALS.md#state--a-case-starts-from-a-snapshot).
+- **Presentation tools** — data tools with `presentation` instead of `request`
+  select evidence cards by known ID — this turn's, or the last 64 the session
+  ledger kept (snapshots seed them as `evidence.cards`). They report shown/dropped IDs,
+  emit `insika.ui` (web channel: `ui`) and select the outbox attachments. Evidence
+  cards carry IDs; empty selections suppress automatic card delivery. Includes
+  `ui_components` / `no_ui` eval assertions and Doctor diagnostics.
+  See [Tools](docs/TOOLS.md#presentation-tools-the-model-picks-ids-the-engine-shows-the-cards).
+- **Fencing** — opt-in per agent through the DSL, payload or Studio. Sanitizes
+  ordinary tool result strings, memory text and injected knowledge summaries, and adds a fixed
+  identity-layer notice. The tool-string cap `fencing.max_chars` defaults to 12,000; the agent flag
+  defaults to off — and stays off in this release: flipping the default waits for the
+  golden-case comparison with fencing on ([Releasing](docs/RELEASING.md), gate 4).
+  Doctor warns for unfenced agents exposed by relay/widget env configuration.
+  See [Agents](docs/AGENTS.md#fencing--third-party-text-is-data-never-instructions).
+
+### Changed
+
+- **Cache boundary** — explicit Anthropic cache control ends at the identity layer;
+  volatile system text follows in a separate block. Prefix fingerprints cover
+  identity and tool schemas; memory/knowledge/request changes retain separate
+  diagnostic digests without reporting identity-prefix invalidation.
+  See [Context](docs/CONTEXT.md#the-provider-prefix-cache).
+- **Serial writes in parallel batches** — tools marked `side_effect` acquire a
+  per-session serial gate before the shared concurrency slot. Independent reads
+  can overlap writes; queued writes do not consume that shared slot. MCP tools
+  annotated `readOnlyHint` are reads.
+- Memory and knowledge extraction read only nonblank user/assistant text, preserving
+  original transcript indexes. Direct tool messages are excluded; assistant
+  paraphrases can still reach extraction. This applies regardless of `fencing`.
+- A tool's own `{"status":"blocked"}` answer is a call that ran: only the engine's
+  gate refusal reports `blocked` on `:tool_result`, the trace and `tools:report`.
+- A Studio save that changes a tool's HTTP method re-derives `side_effect`.
+
+### Fixed
+
+- Data tools declaring `evidence` no longer fail when the envelope parses an
+  already-parsed `Evidence::Spec`.
+- Studio tool saves preserve `evidence` and `presentation` declarations.
+- `scripts/serve_real.rb` passes channel and settings stores to the edge, enabling
+  configured relay/widget routes and the eval seeding setting in the demo server.
+- Fencing: the notice ships with the flag regardless of the `context_providers`
+  allowlist; briefing values and the compaction summary are sanitized too; evidence
+  item ids stay byte-exact for the model (only the line is sanitized).
+- Provenance: a schema-optional parameter the model omits is not checked; a blocked
+  call on a one-shot turn no longer fails emitting `tool_blocked`.
+- `POST /v1/conversations/:id/seed` decodes a percent-encoded conversation id.
+- Widget `ui` cards link only `http(s)` urls.
+- The evidence ledger reads the session row once per turn, not once per gated call.
+- Studio reads its templates as UTF-8 regardless of the process locale: a host with
+  no `LANG` answered 500 on the login page (found by the release install proof).
+
+
 ## [0.8.0] - 2026-08-31
 
 The post-consolidation hardening wave: the last two OpenClaw-era names are gone

data/README.md

@@ -16,9 +16,11 @@ web control UI. Point an existing Responses client at it and serve many agents f
 deployment.
 
 - **Drop-in `/v1/responses`** — SSE streaming and usage, the shape existing clients already speak.
-- **Durable & resumable** — every turn checkpoints; a crash resumes without repeating side-effects.
+- **Durable & resumable** — every turn checkpoints; recorded side-effect calls are deduplicated on replay. External writes still need idempotency.
 - **Agents as data** — agents, prompts, skills and tools are editable at runtime (UI or API), no redeploy.
-- **Tools & skills** — code tools, data-defined tools, MCP import; skills load on demand.
+- **Tools & skills** — code, HTTP data and live MCP tools; skills load on demand.
+- **Evidence-backed actions** — ID checks before writes, serial side effects per session, and selected evidence cards ([Tools](docs/TOOLS.md)).
+- **Snapshot evals** — seed a case's starting state and check calls, refusals, replies and cards ([Evals](docs/EVALS.md)).
 - **Safe by default** — content-safety guardrails, an egress guard, confined execution, approvals, edge limits.
 - **Observable** — an event stream, per-session tool-call traces, optional OpenTelemetry.
 - **~0.4 ms of engine per turn** — p50 overhead on a neutral, key-free benchmark you can rerun yourself ([methodology](docs/BENCHMARK.md)).
@@ -106,7 +108,7 @@ navigates by.
 
 - [Agents](docs/AGENTS.md) — the AgentProfile and every key on it; create and edit at runtime.
 - [Limits and policy](docs/POLICY.md) — the five layers: allowed tools, approvals, guardrails, edge limits, reasoning.
-- [Tools](docs/TOOLS.md) — code vs data vs MCP tools, manifests, egress troubleshooting.
+- [Tools](docs/TOOLS.md) — code, HTTP, MCP and presentation tools; evidence gates and serial writes.
 - [Skills](docs/SKILLS.md) — the SKILL.md format and progressive loading.
 - [Context](docs/CONTEXT.md) — what fills a turn's prompt; budget, eviction, memory.
 - [Workflows](docs/WORKFLOWS.md) — deterministic orchestration of several agents: the five patterns, and when to let the model choose instead.
@@ -137,10 +139,11 @@ navigates by.
 - [Load test](docs/LOADTEST.md) — load-testing and data topology.
 - [Soak](docs/SOAK.md) — the long run that finds what a short one cannot.
 - [Benchmark](docs/BENCHMARK.md) — the neutral, reproducible, provider-free engine benchmark.
+- [Performance](docs/PERFORMANCE.md) — what keeps a turn cheap (fibers, SQLite group commit, memory trim) and what was tried and left out.
 
 **Improve**
 
-- [Evals](docs/EVALS.md) — the cases that grade an agent: rubrics, the judge panel, and the pre-merge gate.
+- [Evals](docs/EVALS.md) — snapshot cases, tool/UI assertions, rubrics, the judge panel and the pre-merge gate.
 - [Refinement](docs/REFINEMENT.md) — read an agent's own traffic back as a ranked report of what broke.
 - [Outcomes and follow-ups](docs/OUTCOMES.md) — what the traffic was worth in business terms, and the tool that comes back on a promise.
 - [Knowledge](docs/KNOWLEDGE.md) — extract durable concepts from finished conversations into a per-agent knowledge base; provenance-stamped, PII-redacted, best-effort with a re-scan recovery path.
@@ -176,6 +179,7 @@ and [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md). Vulnerabilities go through
 
 ## Status
 
-Pre-1.0 — published on [RubyGems](https://rubygems.org/gems/insika); APIs may
-still change between minor versions ([CHANGELOG.md](CHANGELOG.md)). Licensed
+Published on [RubyGems](https://rubygems.org/gems/insika) and follows
+[Semantic Versioning](https://semver.org/) from 1.0.0: a breaking change only lands in
+a new major version ([CHANGELOG.md](CHANGELOG.md)). Licensed
 **MIT** ([LICENSE](LICENSE)).

data/bin/insika

@@ -390,7 +390,7 @@ def evals_simulate(argv)
   # paired comparison, which it silently invalidates.
   require "securerandom"
   conv = opts[:conv] || "sim-#{golden.id}-#{SecureRandom.hex(4)}"
-  run = simulator.run(persona: golden.persona, agent: target_agent, conv: conv)
+  run = simulator.run(persona: golden.persona, agent: target_agent, conv: conv, state: golden.state)
 
   verdict = judge && judge.score_conversation(
     rubric: golden.rubric, transcript: run.transcript, policy: golden.policy,
@@ -505,6 +505,9 @@ def local_side_effect_tools(agent)
   profile = Insika::StoredProfileSource.new(config_store: config_store).fetch(agent)
   return nil if profile.nil?
 
+  # Kits add reachable tools at turn time; the swap list must count them too.
+  profile = Insika::Kits.apply(profile, Insika::SettingsStore.new(config_store: config_store).kits)
+
   registry = Insika::OverlayToolRegistry.new(
     base: Insika::ToolRegistry.new, tool_store: Insika::ToolStore.new(config_store: config_store),
     http: Insika::HttpClient.new

data/bin/insika-router

@@ -34,7 +34,6 @@ module Insika
       module_function
 
       def main
-        Insika::EnvSchema.reconcile_legacy!
         pool = build_pool
         app = Insika::Router::App.new(
           pool: pool,