insika 0.8.0 → 1.0.1

data/lib/insika/context/providers/pending_confirmation.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Insika
+  module Context
+    module Providers
+      # The read path of a customer confirmation: the calls the envelope held on
+      # an earlier turn of this session, rendered at the TAIL of the context —
+      # right before the message that answers them — so the last thing the model
+      # reads before replying is the question the customer is replying to. Zero
+      # bytes when nothing is open, which is every turn of most conversations.
+      class PendingConfirmation < ContextProvider
+        def initialize(pending_action_store:)
+          @store = pending_action_store
+        end
+
+        def id = "pending_confirmation"
+
+        # Pack-declared: no customer_confirm -> no provider.
+        def enabled_for?(profile)
+          list = profile.respond_to?(:customer_confirm) ? profile.customer_confirm : nil
+          !Array(list).empty?
+        end
+
+        def allowlisted? = false # `customer_confirm` is the opt-in, not the allowlist
+
+        def call(request)
+          session = request.respond_to?(:session) ? request.session : nil
+          return [] if session.nil? || @store.nil?
+
+          open = @store.open_for_session(session.id, kind: PendingActionStore::CUSTOMER)
+          return [] if open.empty?
+
+          # A tail fragment IS a history message ({role:, content:}), like the
+          # Briefing's recitation — the Builder appends it after the transcript.
+          [ContextFragment.build(content: { role: :user, content: render(open) }, placement: :tail,
+                                 pinned: true, priority: Context::Priority::PENDING_CONFIRMATION, source: id)]
+        end
+
+        private
+
+        def render(open)
+          lines = open.map { |pa| "- #{pa.tool} #{JSON.generate(pa.args || {})} — pending_id #{pa.id}" }
+          "## Awaiting the customer's confirmation\n#{lines.join("\n")}\n" \
+            "Call confirm_pending only if the customer's message agrees to exactly this. " \
+            "Anything else — a change, a question, a new request — is cancel_pending."
+        end
+      end
+    end
+  end
+end

data/lib/insika/context/providers/prompt.rb

@@ -33,6 +33,9 @@ module Insika
           "the user you found nothing. Do not narrate the retries. Then conclude.\n" \
           "- Tool error: read the error, fix the arguments or try another path; never " \
           "repeat the exact same call.\n" \
+          "- Report an action as done only after its tool call returned success. Never " \
+          "say it happened before the call, and never for a call that failed, was " \
+          "blocked, or is still awaiting confirmation.\n" \
           "- A URL in a tool result (e.g. a `url` field): quote it byte-for-byte. Never " \
           "construct, guess, or rewrite the domain, host, or path."
 
@@ -83,7 +86,9 @@ module Insika
           # NO identity at all, and a chatty model answered plausibly enough to hide
           # it. Additive to prompt_files, not exclusive: an agent may carry both.
           parts << profile&.base_prompt.to_s
-          Array(profile&.prompt_files).each { |src| parts << read_source(profile&.id, src.to_s) }
+          sources = Array(profile&.prompt_files)
+          stored = stored_files(profile, sources)
+          sources.each { |src| parts << read_source(stored, src.to_s) }
           identity = parts.reject { |p| p.nil? || p.strip.empty? }.join("\n\n")
           # Discipline rides an EXISTING identity, never substitutes one: an
           # empty identity here is fatal (`call` raises), not silently patched
@@ -109,10 +114,18 @@ module Insika
           @system_files.list.map { |name| @system_files.read(name).to_s }
         end
 
+        # The agent's files from ONE store read (`contents`); an agent_files object
+        # that only answers `read(agent_id, name)` is read per file, as before.
+        def stored_files(profile, sources)
+          return {} if sources.empty? || profile.id.nil? || @agent_files.nil?
+          return @agent_files.contents(profile.id) if @agent_files.respond_to?(:contents)
+
+          sources.to_h { |src| [src.to_s, @agent_files.read(profile.id, src.to_s)] }.compact
+        end
+
         # Per-agent store first, disk second (compat/seed).
-        def read_source(agent_id, src)
-          stored = agent_id && @agent_files&.read(agent_id, src)
-          return stored if stored
+        def read_source(stored, src)
+          return stored[src] if stored[src]
           return File.read(src, encoding: "UTF-8") if File.exist?(src)
 
           ""

data/lib/insika/context/providers/session.rb

@@ -39,7 +39,7 @@ module Insika
               source: id
             )
           end
-          compaction ? [compaction_fragment(compaction)] + fragments : fragments
+          compaction ? [compaction_fragment(compaction, request)] + fragments : fragments
         end
 
         private
@@ -71,7 +71,11 @@ module Insika
         # Symbol-keyed message preserving tool_calls / tool_call_id when present
         # (a plain message keeps just {role, content} — parity with the old shape).
         def normalize(msg)
+          return msg if msg["native_compaction"]
+
           h = { role: msg[:role] || msg["role"], content: msg[:content] || msg["content"] }
+          attachments = msg[:attachments] || msg["attachments"]
+          h[:attachments] = attachments if attachments && !attachments.empty?
           tool_calls = msg[:tool_calls] || msg["tool_calls"]
           tool_call_id = msg[:tool_call_id] || msg["tool_call_id"]
           h[:tool_calls] = tool_calls if tool_calls
@@ -114,12 +118,44 @@ module Insika
           fresh = fresh_session(session)
           return [[], nil] if fresh.nil?
 
-          messages = fresh.messages || []
+          # Operator corrections affect replay only, never the stored content or tool protocol.
+          messages = (fresh.messages || []).map do |message|
+            if message["role"] == "assistant" && Array(message["tool_calls"]).empty? && message["context_content"].is_a?(String)
+              message.merge("content" => message["context_content"])
+            else
+              message
+            end
+          end
           state = fresh.respond_to?(:compaction) ? fresh.compaction : nil
           upto = state ? state["upto"].to_i : 0
-          return [messages, nil] unless upto.positive? && Coercion.present?(state["summary"])
+          if upto.positive? && state["native"]
+            # ponytail: budget the full fallback too; model-aware allocation can
+            # recover this headroom once model selection precedes context building.
+            prefix = { "native_compaction" => state["native"], "messages" => without_no_reply(messages.take(upto)) }
+            return [[prefix] + without_no_reply(messages.drop(upto)), nil]
+          end
+          return [without_no_reply(messages), nil] unless upto.positive? && Coercion.present?(state["summary"])
+
+          [without_no_reply(messages.drop([upto, messages.size].min)), state]
+        end
 
-          [messages.drop([upto, messages.size].min), state]
+        # `NO_REPLY` is the OpenClaw gateway's silence sentinel. Conversations migrated
+        # from it carry it as agent replies, and the compaction summary restates the
+        # rule ("call_support → responder NO_REPLY"); the Insika prompts forbid the
+        # word (silence is an empty answer here), so replaying it only teaches the
+        # model to write it (Loja Exemplo and Supermercado Exemplo, 23/10/2026).
+        # Replay-only, like the operator corrections above: the stored transcript is
+        # untouched. Applied after the compaction cut so `upto` keeps indexing the
+        # stored list. A message left empty is dropped — the customer never saw it.
+        def without_no_reply(messages)
+          messages.filter_map do |message|
+            content = message["content"]
+            next message unless message["role"] == "assistant" && Array(message["tool_calls"]).empty? &&
+                                content.is_a?(String) && content.include?("NO_REPLY")
+
+            kept = content.lines.grep_v(/NO_REPLY/).join.strip
+            message.merge("content" => kept) unless kept.empty?
+          end
         end
 
         # The compacted prefix as ONE history fragment, rendered FIRST (the
@@ -127,10 +163,14 @@ module Insika
         # provider-agnostic (a mid-history "system" message is not). Priority
         # COMPACTION (59): the "oldest unit" — under budget it drops before any
         # verbatim message. source "compaction" -> its own context-trace category.
-        def compaction_fragment(state)
+        # Fenced when the agent has `fencing` on: the summary is model-written from
+        # customer text, and the notice promises the model this block is material.
+        def compaction_fragment(state, request)
+          summary = state["summary"].to_s
+          summary = Insika::Fence.sanitize_text(summary) if Insika::Fence.enabled?(request.profile)
           ContextFragment.build(
             content: { role: "user",
-                       content: "<conversation_summary>\n#{state['summary']}\n</conversation_summary>" },
+                       content: "<conversation_summary>\n#{summary}\n</conversation_summary>" },
             placement: :history,
             priority: Context::Priority::COMPACTION,
             source: "compaction"

data/lib/insika/context/reranker.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Insika
+  module Context
+    # Optional second pass over already scoped retrieval candidates.
+    class Reranker
+      MAX_INPUT_TOKENS = 4_000
+
+      def initialize(llm:)
+        @llm = llm
+      end
+
+      # Returns indexes into documents, or nil so the caller keeps lexical order.
+      def select(query:, documents:, config:, top_k:, emit: nil, source: "Knowledge", budget: MAX_INPUT_TOKENS)
+        return nil if documents.empty?
+
+        # The same estimator used by the context budget bounds the provider input.
+        tokens = [budget.to_i, MAX_INPUT_TOKENS].min
+        query_tokens = [tokens / 4, 1_000].min
+        per_document = [(tokens - query_tokens) / documents.length, 400].min
+        return nil if per_document < 1
+
+        bounded = documents.map { |text| trim(Insika::Safety::Detectors.redact(text).first, per_document) }
+        bounded_query = trim(Insika::Safety::Detectors.redact(query).first, query_tokens)
+        llm = operation_context(emit, config)
+        result = Async::Task.current.with_timeout(config.fetch("timeout_seconds")) do
+          llm.rerank(bounded_query, bounded, provider: config.fetch("provider"),
+                     model: config.fetch("model"), top_n: top_k)
+        end
+        indexes = result.results.map(&:index)
+        unless indexes.length == [top_k, documents.length].min &&
+               indexes.all? { |index| index.is_a?(Integer) && index >= 0 && index < documents.length } &&
+               indexes.uniq.length == indexes.length
+          safe_emit(emit, :provider_warning, { provider: source, message: "invalid rerank indexes" })
+          return nil
+        end
+        safe_emit(emit, :retrieval_reranked,
+                  { provider: source, candidate_count: documents.length, selected_count: indexes.length })
+        indexes
+      rescue StandardError => error
+        # Provider messages may quote the query or a document. Only the class is safe.
+        safe_emit(emit, :provider_warning, { provider: source, message: "rerank failed: #{error.class.name}" })
+        nil
+      end
+
+      private
+
+      def trim(value, limit)
+        text = value.to_s[0, limit * 4]
+        text = text[0...-1] while TokenEstimator.estimate(text) > limit
+        text
+      end
+
+      def safe_emit(emit, type, data)
+        emit&.call(type, data)
+      rescue StandardError
+        nil
+      end
+
+      def operation_context(emit, config)
+        source = @llm.respond_to?(:call) ? @llm.call : @llm
+        return source unless emit && source.respond_to?(:config)
+
+        require "ruby_llm"
+        require_relative "../telemetry/ruby_llm_instrumenter"
+        copy = source.config.dup
+        copy.instrumenter = Insika::Telemetry::RubyLLMInstrumenter.new(
+          delegate: copy.instrumenter, operation: "rerank", model: config.fetch("model"),
+          emit: ->(type, data) { safe_emit(emit, type, data) }
+        )
+        RubyLLM::Context.new(copy)
+      end
+    end
+  end
+end

data/lib/insika/distill.rb

@@ -73,7 +73,7 @@ module Insika
       DROP_KEYS = %w[schema unknown_key oversized bad_turns duplicate capped].freeze
 
       # ask:   ->(prompt) { "<raw model text>" } | something answering #content
-      #        (+ #input_tokens/#output_tokens/#cached_tokens for cost).
+      #        (+ RubyLLM-compatible #tokens for cost).
       # model: the ref recorded in the events ("utility_model" default).
       attr_reader :model
 
@@ -93,7 +93,7 @@ module Insika
       # Drops are counted, never fixed up.
       def distill(prompt:, message_count:, max_proposals: 10)
         answer = @ask.call(prompt)
-        raw = parse(text_of(answer))
+        raw = parse(answer)
         proposals = []
         dropped = DROP_KEYS.to_h { |k| [k, 0] }
         seen = {}
@@ -124,20 +124,25 @@ module Insika
       # nil when the provider said nothing — never 0 (the Proposer's
       # discipline). The cached prefix is INCLUDED in the spent total.
       def cost_of(answer)
-        return nil unless answer.respond_to?(:input_tokens) && answer.respond_to?(:output_tokens)
+        return nil unless answer.respond_to?(:tokens)
 
-        input = answer.input_tokens.to_i
-        output = answer.output_tokens.to_i
-        cached = answer.respond_to?(:cached_tokens) ? answer.cached_tokens.to_i : 0
-        spent = input + output + cached
+        usage = answer.tokens
+        input = usage.input.to_i
+        output = usage.output.to_i
+        cached = usage.cache_read.to_i
+        spent = input + output + cached + usage.cache_write.to_i
         spent.positive? ? { "spent" => spent, "cached" => cached } : nil
       end
 
-      # Fences are stripped, the payload parsed STRICTLY: a model that
-      # improvises a schema fails here instead of producing half a proposal.
-      def parse(raw)
-        body = raw.strip.gsub(/\A```(?:json)?\s*|\s*```\z/, "")
-        parsed = JSON.parse(body)
+      # Native responses own JSON parsing; injected text asks retain their
+      # existing fenced-JSON contract. Domain validation still runs below.
+      def parse(answer)
+        parsed = if answer.respond_to?(:parsed)
+                   answer.parsed
+                 else
+                   JSON.parse(text_of(answer).strip.gsub(/\A```(?:json)?\s*|\s*```\z/, ""))
+                 end
+        parsed = parsed["items"] if parsed.is_a?(Hash)
         raise Unusable, "the distiller's answer is not an array" unless parsed.is_a?(Array)
 
         parsed
@@ -215,8 +220,12 @@ module Insika
         require "ruby_llm"
         llm ||= RubyLLM
         lambda do |prompt|
+          # DeepSeek's native adapter uses JSON-object mode, requiring an envelope.
+          schema = { "type" => "object", "properties" => { "items" => PROPOSAL_SCHEMA.json_schema },
+                     "required" => ["items"], "additionalProperties" => false }
           llm.chat(model: model, provider: provider, assume_model_exists: true)
-             .with_temperature(0).ask(prompt)
+             .with_temperature(0).with_schema("schema" => schema, "strict" => false)
+             .ask("#{prompt}\n\nReturn the requested array inside a JSON object with the key \"items\".")
         end
       end
     end

data/lib/insika/doctor.rb

@@ -180,7 +180,8 @@ module Insika
                     check_soak_envelope check_turn_timing check_grounding check_cache_layers
                     check_memory_scopes check_funnel_declarations check_followup check_distill
                     check_compaction check_harvest check_schedules check_guardrail_corpora
-                    check_tool_allowlist_policy]
+                    check_tool_allowlist_policy check_fencing check_eval_seeding
+                    check_presentation_tools check_provenance check_customer_confirm]
 
     def safe(check)
       Array(send(check))
@@ -315,16 +316,18 @@ module Insika
       [Finding.new(check: "default-model", severity: :warn, message: msg, fix: fix)]
     end
 
+    def backend_name = @backend.class.name.split("::").last
+
     def check_db
-      unless @backend.is_a?(Insika::Stores::SQLite)
+      unless Insika::Stores.durable?(@backend)
         return [Finding.new(check: "db", severity: :info,
                             message: "ephemeral backend (INSIKA_DB unset) — config and state do NOT survive a restart", fix: nil)]
       end
 
       @backend.get("__doctor__", "probe") # a read round-trips the handle; raises if the file is broken
-      [ok("db", "durable backend: SQLite (readable)")]
+      [ok("db", "durable backend: #{backend_name} (readable)")]
     rescue StandardError => e
-      [Finding.new(check: "db", severity: :error, message: "SQLite backend not usable: #{e.class}: #{e.message}", fix: nil)]
+      [Finding.new(check: "db", severity: :error, message: "#{backend_name} backend not usable: #{e.class}: #{e.message}", fix: nil)]
     end
 
     def check_llm_provider
@@ -836,6 +839,7 @@ def wrapped_content?(content) = /\A\s*\{\s*"[^"]+"\s*=>/.match?(content.to_s)
     # identity block bills a cache write every turn).
     IDENTITY_BUILTINS = %w[
       Insika::Context::Providers::Prompt
+      Insika::Context::Providers::FenceNotice
       Insika::Context::Providers::Skill
       Insika::Context::Providers::ToolSearch
     ].freeze
@@ -942,6 +946,96 @@ def wrapped_content?(content) = /\A\s*\{\s*"[^"]+"\s*=>/.match?(content.to_s)
 
     def names_tool_allowlist?(raw) = Array(raw["policies"]).any? { |p| p.to_s == "tool_allowlist" }
 
+    # A stored agent that allows a PRESENTATION tool but no tool declaring
+    # `evidence`. The presentation tool shows only cards an evidence tool returned
+    # this session, so with no evidence tool in reach every call drops every id —
+    # the model keeps asking to show products and nothing ever appears. Silent
+    # unless a presentation tool exists. Data tools only: a code tool's evidence
+    # lives in registry metadata the doctor does not read.
+    def check_presentation_tools
+      return [] unless @tool_store && @profile_source
+
+      raws = @tool_store.all_raw
+      presenting = raws.select { |r| r["presentation"] }.map { |r| r["name"].to_s }
+      return [] if presenting.empty?
+
+      evidence = raws.select { |r| r["evidence"] }.map { |r| r["name"].to_s }
+      bad = @profile_source.all.filter_map do |profile|
+        allowed = allowed_data_tools(profile, raws)
+        shows = presenting & allowed
+        next if shows.empty? || !(evidence & allowed).empty?
+
+        Finding.new(check: "presentation-tools", severity: :warn, fix: nil,
+                    message: "agent '#{profile.id}' allows #{shows.join(', ')} but no tool declaring " \
+                             "evidence — a presentation tool can only show cards an evidence tool " \
+                             "returned this session, so every call would drop every id. Allow the " \
+                             "search tool that declares `evidence`, or drop the presentation tool.")
+      end
+      return bad unless bad.empty?
+
+      [ok("presentation-tools", "#{presenting.length} presentation tool(s): every agent that shows cards " \
+                                "also allows an evidence tool")]
+    end
+
+    # The data tools a profile may call, by the allowlist's own rules: nil lists =
+    # all; otherwise names ∪ groups; deny wins.
+    def allowed_data_tools(profile, raws)
+      names = profile.tools_allow.nil? ? nil : Array(profile.tools_allow).map(&:to_s)
+      groups = profile.tools_allow_groups.nil? ? nil : Array(profile.tools_allow_groups).map(&:to_s)
+      allowed = if names.nil? && groups.nil?
+                  raws.map { |r| r["name"].to_s }
+                else
+                  Array(names) | raws.select { |r| Array(groups).include?(r["group"].to_s) }.map { |r| r["name"].to_s }
+                end
+      allowed - Array(profile.tools_deny).map(&:to_s)
+    end
+
+    def check_provenance
+      return [] unless @tool_store && @profile_source.respond_to?(:all_raw)
+
+      tools = @tool_store.all_raw
+      @profile_source.all_raw.filter_map do |raw|
+        allowed = tools.select do |tool|
+          name = tool["name"]
+          unrestricted = raw["tools_allow"].nil? && raw["tools_allow_groups"].nil?
+          (unrestricted || Array(raw["tools_allow"]).include?(name) ||
+            Array(raw["tools_allow_groups"]).include?(tool["group"])) &&
+            !Array(raw["tools_deny"]).include?(name)
+        end
+        gated = allowed.select { |tool| tool["requires_evidence"] }
+        next if gated.empty? || allowed.any? { |tool| tool["evidence"] }
+
+        Finding.new(check: "provenance", severity: :warn, fix: nil,
+                    message: "agent '#{raw["id"]}' allows #{gated.map { |t| t["name"] }.join(', ')} " \
+                             "with requires_evidence but no stored evidence tool — verify that an allowed code tool supplies evidence")
+      end
+    end
+
+    # `customer_confirm` names tools; one the agent denies, or leaves out of an
+    # explicit allowlist, is a hold that can never happen. An allowlist carrying an
+    # `mcp:` entry is not explicit about tool NAMES (the server contributes them),
+    # so it is not judged.
+    def check_customer_confirm
+      return [] unless @profile_source
+
+      findings = @profile_source.all.flat_map do |profile|
+        names = profile.respond_to?(:customer_confirm) ? Array(profile.customer_confirm) : []
+        next [] if names.empty?
+
+        allow = profile.tools_allow
+        explicit = !allow.nil? && Array(allow).none? { |a| a.to_s.start_with?("mcp:") }
+        dead = names.select do |name|
+          Array(profile.tools_deny).include?(name) || (explicit && !Array(allow).include?(name))
+        end
+        next [] if dead.empty?
+
+        [Finding.new(check: "customer_confirm", severity: :warn, fix: nil,
+                     message: "agent '#{profile.id}' lists #{dead.join(', ')} under customer_confirm but does " \
+                              "not allow the tool — the hold can never happen")]
+      end
+      findings.empty? ? [ok("customer_confirm", "customer_confirm: every held tool is allowed")] : findings
+    end
+
     def check_grounding
       return [] unless @profile_source
 
@@ -1314,6 +1408,9 @@ def wrapped_content?(content) = /\A\s*\{\s*"[^"]+"\s*=>/.match?(content.to_s)
       settings = @settings_store.get
       config = settings["compaction"] || {}
       return [ok("compaction", "in-session compaction off")] unless Coercion.truthy?(config["enabled"])
+      if config["mode"] == "native"
+        return [ok("compaction", "native compaction on for supported Responses models; no summary fallback")]
+      end
 
       if Coercion.presence(config["model"]).nil? && Coercion.presence(settings["utility_model"]).nil?
         [Finding.new(check: "compaction", severity: :warn, fix: nil,
@@ -1325,6 +1422,47 @@ def wrapped_content?(content) = /\A\s*\{\s*"[^"]+"\s*=>/.match?(content.to_s)
       end
     end
 
+    # `evals.seeding` opens POST /v1/conversations/:id/seed: a snapshot written
+    # into a real conversation under the tenant token, before its first turn. Right
+    # on the machine running snapshot evals; wrong left on in production, where any
+    # consumer holding the token could write a customer's history. A warning, not
+    # an error — the operator may be running the evals right now.
+    def check_eval_seeding
+      return [] unless @settings_store
+
+      on = ((@settings_store.get["evals"] || {})["seeding"]) == true
+      return [ok("eval-seeding", "evals.seeding off — conversations cannot be seeded")] unless on
+
+      [Finding.new(check: "eval-seeding", severity: :warn, fix: nil,
+                   message: "evals.seeding is ON — POST /v1/conversations/:id/seed accepts a fabricated " \
+                            "conversation state under the tenant token. Fine while running snapshot " \
+                            "evals; turn it off (Studio > Settings, or `update_settings`) in production.")]
+    end
+
+    # A customer-facing agent — one reachable through an inbound channel: any
+    # agent when the relay is mounted (the event names the agent), the listed
+    # ones for the widget — with `fencing` off reads third-party bytes as-is.
+    # A warning, never an error: the default is off this release on purpose
+    # (the goldens were baselined unfenced), so the message says exactly what
+    # is unsanitized today. No inbound channel = nothing customer-facing = silent.
+    def check_fencing
+      return [] unless @profile_source
+
+      relay = Insika::Coercion.present?(@env["INSIKA_RELAY_TOKEN"])
+      widget = @env["INSIKA_WIDGET_AGENTS"].to_s.split(",").map(&:strip).reject(&:empty?)
+      return [] unless relay || widget.any?
+
+      exposed = @profile_source.all.select { |p| relay || widget.include?(p.id.to_s) }
+      unfenced = exposed.reject { |p| Insika::Fence.enabled?(p) }.map(&:id)
+      return [ok("fencing", "fencing on for every agent behind an inbound channel")] if unfenced.empty?
+
+      [Finding.new(check: "fencing", severity: :warn, fix: nil,
+                   message: "agent(s) #{unfenced.join(', ')}: reachable through an inbound channel with " \
+                            "`fencing` off — tool results, <memory> facts and <knowledge> concepts reach " \
+                            "the model byte-for-byte (invisible characters, forged turn markers and " \
+                            "transcript-shaped tags included). Set `fencing true` on the agent.")]
+    end
+
     # the harvest check — per profile WITH a harvest hash:
     #   declared-without-model warn (D12), no grounding matcher warn (D3),
     #   malformed negative list error (D4), else ok with the pending counts.

data/lib/insika/dsl/runtime.rb

@@ -114,7 +114,8 @@ module Insika
           edge_limiter: c[:edge_limiter],
           executor_extra: { settings_store: c[:settings_store], tool_trace_store: c[:tool_trace_store],
                             context_trace_store: c[:context_trace_store],
-                            cache_series_store: c[:cache_series_store], llm: @llm }
+                            cache_series_store: c[:cache_series_store], llm: @llm,
+                            llm_refresh: -> { c[:configurator].refresh } }
         )
         register_authoring_commands(graph, c)
         register_workflows(graph)
@@ -153,7 +154,8 @@ module Insika
         end
 
         graph.bus.register(:trigger_workflow, Insika::Commands::TriggerWorkflow.new(
-                                                profiles: graph.profiles, session_store: graph.session_store,
+                                                profiles: Insika::AgentDefaults.for_turns(graph.profiles, @components[:settings_store]),
+                                                session_store: graph.session_store,
                                                 task_store: graph.task_store, executor: graph.executor,
                                                 workflow_registry: graph.workflow_registry
                                               ))
@@ -180,9 +182,35 @@ module Insika
             attrs[:headers] = existing["headers"]
           end
           mcp_store.upsert(attrs)
+          list_tools_once(c, attrs[:name])
         end
       end
 
+      # A CODE-DECLARED server whose tools were never listed offers the agent
+      # NOTHING: the registry's `entries` reads the cached descriptors, so an empty
+      # cache means the model is never told those tools exist and answers out of its
+      # own head instead — silently, which is the worst shape a missing tool can
+      # take (a bench run caught exactly that: an agent with no catalogue invented
+      # one). So the FIRST boot lists them.
+      #
+      # A failure to list does NOT stop the boot — a stdio server behind a closed
+      # gate and a server that is momentarily down are both ordinary, and a
+      # deployment that refuses to start over either would be worse than the problem.
+      # It is said out loud instead, naming the consequence, because the failure this
+      # exists to end is the silent one.
+      #
+      # Only when the cache is empty. A later boot is free, and an operator who
+      # refreshed by hand is not overruled.
+      def list_tools_once(c, name)
+        record = c[:mcp_store].get_raw(name.to_s)
+        return unless record && record["enabled"] && Array(record["tools_cache"]).empty?
+
+        c[:mcp_tool_registry].refresh(name.to_s)
+      rescue StandardError => e
+        warn "insika: mcp \"#{name}\" was declared in code but its tools could not be listed " \
+             "(#{e.message}). The agent runs WITHOUT them until `insika mcp refresh #{name}` succeeds."
+      end
+
       def build_components(backend, spine)
         config_store = Insika::ConfigStore.new(store: backend)
         settings_store = Insika::SettingsStore.new(config_store: config_store)
@@ -231,14 +259,16 @@ module Insika
             base: "", catalog: c[:prompt_catalog],
             agent_files: c[:agent_file_store], system_files: c[:system_file_store]
           ),
+          Insika::Context::Providers::FenceNotice.new,
           Insika::Context::Providers::Skill.new(catalog: c[:skill_catalog]),
           Insika::Context::Providers::SkillTrigger.new(catalog: c[:skill_catalog]),
           Insika::Context::Providers::ToolSearch.new(catalog: c[:tool_catalog]),
-          Insika::Context::Providers::Memory.new(store: spine.memory_store),
-          Insika::Context::Providers::Knowledge.new(store: spine.knowledge_store),
+          Insika::Context::Providers::Memory.new(store: spine.memory_store, llm: @llm),
+          Insika::Context::Providers::Knowledge.new(store: spine.knowledge_store, llm: @llm),
           # Session briefing: read path. Inert for agents without briefing_fields.
           # Before Session, so the durable head renders above the transcript and
           # the tail recitation lands after it.
+          Insika::Context::Providers::PendingConfirmation.new(pending_action_store: spine.pending_action_store),
           Insika::Context::Providers::Briefing.new(session_store: spine.session_store),
           Insika::Context::Providers::Session.new(session_store: spine.session_store)
         ] # NOT frozen: load_plugins appends plugin providers at boot
@@ -267,6 +297,8 @@ module Insika
         # the LGPD access right — the Studio Customers drill exports.
         bus.register(:export_customer_memory, Insika::Commands::ExportCustomerMemory.new(memory_store: mem, event_stream: es))
         bus.register(:update_settings, Insika::Commands::UpdateSettings.new(settings_store: c[:settings_store], event_stream: es))
+        bus.register(:write_kit, Insika::Commands::WriteKit.new(settings_store: c[:settings_store], event_stream: es))
+        bus.register(:delete_kit, Insika::Commands::DeleteKit.new(settings_store: c[:settings_store], event_stream: es))
         bus.register(:upsert_llm_provider, Insika::Commands::UpsertLLMProvider.new(provider_store: c[:provider_store], configurator: c[:configurator], event_stream: es))
         bus.register(:delete_llm_provider, Insika::Commands::DeleteLLMProvider.new(provider_store: c[:provider_store], configurator: c[:configurator], event_stream: es))
         bus.register(:upsert_mcp, Insika::Commands::UpsertMcp.new(mcp_store: c[:mcp_store], mcp_registry: c[:mcp_tool_registry], event_stream: es))
@@ -309,6 +341,7 @@ module Insika
         return nil unless RubyLLM.respond_to?(:context)
 
         primary = provider_name
+        # Preserve the host instrumenter; Executor wraps a copy for each task chat.
         RubyLLM.context do |cfg|
           provider_names.each do |provider|
             # The explicit api_key/api_base belong to the PRIMARY provider; the

data/lib/insika/dsl/server_boot.rb

@@ -95,6 +95,8 @@ module Insika
           session_store: @graph.session_store,
           settings_store: @rt.component(:settings_store), llm_provider_store: @rt.component(:provider_store),
           mcp_store: @rt.component(:mcp_store), system_file_store: @rt.component(:system_file_store),
+          llm_trace_store: @graph.llm_trace_store,
+          model_metrics_store: @graph.model_metrics_store,
           tool_trace_store: @rt.component(:tool_trace_store),
           context_trace_store: @rt.component(:context_trace_store),
           # the per-agent cache-hit series (agent-detail card).
@@ -134,20 +136,10 @@ module Insika
           # config (nil without INSIKA_ARTIFACT_SIGNING_KEY) decides whether a
           # signed sharing link exists at all.
           artifact_store: @graph.artifact_store,
-          artifact_signing: artifact_signing
+          artifact_signing: Insika::ArtifactSigning.studio_config
         )
       end
 
-      # -> { key:, ttl:, base_url: } | nil (no signing key -> no signed surface).
-      def artifact_signing
-        key = Insika::EnvSchema.read("INSIKA_ARTIFACT_SIGNING_KEY")
-        return nil if key.to_s.empty?
-
-        { key: key,
-          ttl: (Insika::EnvSchema.read("INSIKA_ARTIFACT_SIGNING_TTL") || 604_800).to_i,
-          base_url: Insika::Coercion.presence(Insika::EnvSchema.read("INSIKA_PUBLIC_URL")).to_s }
-      end
-
       # The frozen criterion — best-effort at boot: a bare install
       # without the env var renders the ruler's hole instead of
       # crashing the Studio.
@@ -166,7 +158,7 @@ module Insika
       end
 
       def persistence
-        @graph.durable? ? "durable (sqlite)" : "ephemeral (memory)"
+        @graph.durable? ? "durable (#{@graph.backend.class.name.split("::").last.downcase})" : "ephemeral (memory)"
       end
 
       def banner(telemetry = nil)