insika 0.9.0 → 1.0.1

data/lib/insika/config_store.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "json"
+require "securerandom"
 require "time"
 
 module Insika
@@ -34,39 +36,117 @@ module Insika
 
     class UnknownScope < Insika::Error; end
 
-    def initialize(store:)
+    # Rewritten on every config write. A cache sees another process's write by
+    # finding a different token. Outside SCOPES, so no authored scope lists it.
+    VERSION_SCOPE = "#{SCOPE_PREFIX}:_version"
+    VERSION_KEY = "token"
+    # The server's recheck window (seconds): how stale another worker's write may
+    # be seen. Embedders keep 0 (no cache) unless they opt in.
+    RECHECK = 1.0
+    # Fiber-storage flag a running turn sets. The cache serves only turns: Studio
+    # requests and pack imports read a record, change it and write it back, and
+    # that read must see another worker's write that landed a moment ago.
+    TURN_KEY = :insika_in_turn
+
+    # recheck: 0 = no cache, every read goes to the store (the default).
+    # recheck > 0 = reads made inside a turn are served from memory; the version token is re-read
+    # at most once per `recheck` seconds and a changed token drops the cache.
+    def initialize(store:, recheck: 0, clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
       @store = store
+      @recheck = recheck
+      @clock = clock
+      @cache = {}
+      @token = nil
+      @checked_at = nil
+      @gen = 0
+      @lock = Mutex.new
     end
 
+    attr_reader :recheck
+
+    # The token every config write bumps. Another process reads it to learn that
+    # something changed since it last looked (one small store read, never cached).
+    def version_token = @store.get(VERSION_SCOPE, VERSION_KEY)
+
     # Upsert (last-write-wins). -> value (the same Hash that was passed)
     def put(scope, key, value)
-      @store.set(ns(scope), key.to_s, stringify(value))
+      s = ns(scope)
+      @store.transaction do
+        @store.set(s, key.to_s, stringify(value))
+        bump_version
+      end
+      forget
       value
     end
 
     # -> Hash | nil
     def get(scope, key)
-      @store.get(ns(scope), key.to_s)
+      s = ns(scope)
+      cached([:get, s, key.to_s]) { @store.get(s, key.to_s) }
     end
 
     # -> bool (did it exist?)
     def delete(scope, key)
-      @store.delete(ns(scope), key.to_s)
+      s = ns(scope)
+      existed = @store.transaction do
+        @store.delete(s, key.to_s).tap { |gone| bump_version if gone }
+      end
+      forget
+      existed
     end
 
     # -> [String] keys of the scope, sorted lexicographically
     def keys(scope)
-      @store.list(ns(scope))
+      s = ns(scope)
+      cached([:keys, s]) { @store.list(s) }
     end
 
-    # -> [Hash] all records of the scope (lexicographic key order)
+    # -> [Hash] all records of the scope (lexicographic key order), one store call
     def all(scope)
       s = ns(scope)
-      @store.list(s).filter_map { |k| @store.get(s, k) }
+      cached([:all, s]) { @store.entries(s).map(&:last) }
     end
 
     private
 
+    # The cache keeps JSON text, not objects: every hit parses a fresh copy, so a
+    # caller that mutates what it got never changes what the next caller reads.
+    def cached(entry)
+      return yield unless @recheck.positive? && Fiber[TURN_KEY]
+
+      revalidate
+      gen, raw = @lock.synchronize { [@gen, @cache[entry]] }
+      return JSON.parse(raw) if raw
+
+      value = yield
+      # A drop while the read was in flight means the value may predate it.
+      @lock.synchronize { @cache[entry] = JSON.generate(value) if gen == @gen }
+      value
+    end
+
+    def revalidate
+      now = @clock.call
+      return if @checked_at && now - @checked_at < @recheck
+
+      token = @store.get(VERSION_SCOPE, VERSION_KEY)
+      @lock.synchronize do
+        drop unless token == @token
+        @token = token
+        @checked_at = now
+      end
+    end
+
+    def bump_version = @store.set(VERSION_SCOPE, VERSION_KEY, SecureRandom.hex(8))
+
+    # Our own write: drop everything and re-read the token on the next read.
+    def forget = @lock.synchronize { drop; @checked_at = nil }
+
+    # Callers hold @lock. The generation tells an in-flight read its value is stale.
+    def drop
+      @cache.clear
+      @gen += 1
+    end
+
     def ns(scope)
       key = scope.to_s
       raise UnknownScope, "unknown config scope: #{scope.inspect}" unless SCOPES.include?(key)

data/lib/insika/context/priority.rb

@@ -19,6 +19,9 @@ module Insika
       IDENTITY     = 100 # IDENTITY/SOUL (Prompt) — pinned
       FENCE_NOTICE = 99  # the one-sentence fencing notice (FenceNotice) —
                          #   right under the identity, byte-stable, above the boundary
+      PENDING_CONFIRMATION = 96 # the call held for the customer's confirmation
+                         #   (PendingConfirmation) — tail, pinned: it is the
+                         #   question the current message is answering
       RECITATION   = 95  # <recitation> the goal restated at the TAIL of context
                          #   (Briefing). Never cut: it is two lines, and the one
                          #   turn it gets evicted is the long turn that needed it.

data/lib/insika/context/provider.rb

@@ -29,9 +29,9 @@ module Insika
   #                 fall back to tenant || session). Kept separate from `tenant`
   #                 (the <request_context> merchant label) on purpose.
   ContextRequest = Data.define(:session, :message, :profile, :tenant, :vars,
-                               :checkpoint, :memory_scope) do
+                               :checkpoint, :memory_scope, :diagnostics) do
     def initialize(session: nil, message: nil, profile: nil, tenant: nil, vars: {},
-                   checkpoint: nil, memory_scope: nil)
+                   checkpoint: nil, memory_scope: nil, diagnostics: nil)
       super
     end
   end

data/lib/insika/context/providers/knowledge.rb

@@ -9,8 +9,9 @@ module Insika
       # `SkillTrigger`, unlike the static `CatalogProvider` subclasses — this
       # builds its `<knowledge>` block directly in `call`, never a fixed list.
       class Knowledge < ContextProvider
-        def initialize(store:)
+        def initialize(store:, llm: nil)
           @store = store
+          @reranker = Reranker.new(llm: llm) if llm
           # One Index PER TYPE, built once and reused for every agent/turn —
           # never per call. This provider instance itself lives for the
           # process's lifetime (built once at boot, see wiring), so an
@@ -28,15 +29,37 @@ module Insika
         # required? == false (default): a store failure degrades to a
         # :provider_warning, never aborts the turn.
         def call(request)
+          if request.vars&.key?('shared_memory')
+            records = request.vars['shared_memory'].fetch('knowledge', [])
+            hits = records.map { [{name:_1['id'],description:_1['excerpt'],confidence:0.6,provenance:_1['origin'] == 'operator' ? 'curated' : 'observed'}, 'shared'] }
+            return [] if hits.empty?
+            return [ContextFragment.build(content:format_block(hits,true),placement: :system,priority:Context::Priority::KNOWLEDGE,source:id)]
+          end
           config = request.profile.knowledge
           return [] unless config
 
           top_k = positive_int(config["top_k"]) || 5
           index = @indexes[config["index"].to_s]
+          rerank = config["rerank"]
+          candidate_limit = rerank ? rerank.fetch("candidate_limit") : top_k
           matches = index.search(request.profile.id, tenant: request.tenant,
-                                 query: request.message.to_s, top_k: top_k)
+                                 query: request.message.to_s, top_k: candidate_limit)
           return [] if matches.empty?
 
+          if rerank && @reranker
+            # Leave room inside the Builder's outer provider timeout to return
+            # lexical results when the reranker times out.
+            timeout = [rerank.fetch("timeout_seconds"),
+                       (request.profile.limits[:provider_timeout] || 5) * 0.9].min
+            documents = matches.map { |c| [c[:name], c[:description], c[:body]].join("\n") }
+            indexes = @reranker.select(query: request.message.to_s, documents: documents,
+                                       config: rerank.merge("timeout_seconds" => timeout), top_k: top_k,
+                                       emit: request.diagnostics, budget: request.profile.limits[:context_budget] || 8_000)
+            matches = indexes ? indexes.map { |i| matches[i] } : matches.first(top_k)
+          else
+            matches = matches.first(top_k)
+          end
+
           hits = matches.map { |c| [c, "top-K match"] } +
                  expand_links(matches, request, top_k).map { |c| [c, "one-hop link"] }
 

data/lib/insika/context/providers/memory.rb

@@ -5,12 +5,12 @@ module Insika
     module Providers
       # Read path for cross-session memory. Thin adapter over
       # the MemoryStore — same pattern as the Skill/ToolSearch provider: one
-      # `:system` fragment with the tenant's facts + recent notes. Deterministic
-      # (no embeddings/ranking).
+      # `:system` fragment with the tenant's facts + recent notes.
       class Memory < ContextProvider
-        def initialize(store:, notes_limit: 10)
+        def initialize(store:, notes_limit: 10, llm: nil)
           @store = store
           @notes_limit = notes_limit
+          @reranker = Reranker.new(llm: llm) if llm
         end
 
         # Per-agent opt-in. The Builder still applies the `context_providers`
@@ -20,11 +20,28 @@ module Insika
         # required? == false (default): a failure (store unavailable) becomes a
         # :provider_warning + graceful degradation — never aborts the turn.
         def call(request)
+          if request.vars&.key?('shared_memory')
+            records = request.vars['shared_memory'].fetch('facts', [])
+            facts = records.reject { _1['kind'] == 'note' }.map { MemoryStore::Fact.new(key:_1['id'],value:_1['value'].to_s,origin:_1['origin'],created_at:_1['created_at'],updated_at:_1['updated_at'],expires_at:_1['expires_at']) }
+            notes = records.select { _1['kind'] == 'note' }.map { MemoryStore::Note.new(id:_1['id'],text:_1['value'].to_s,created_at:_1['created_at']) }
+            return [] if records.empty?
+            return [ContextFragment.build(content:format_block(facts,notes,true),placement: :system,priority:Context::Priority::MEMORY,source:id)]
+          end
           tenant = memory_scope(request)
           facts = @store.facts(tenant: tenant)
-          notes = @store.notes(tenant: tenant, limit: @notes_limit)
+          config = request.profile.memory_retrieval
+          limit = config ? [@notes_limit, config.dig("rerank", "candidate_limit")].max : @notes_limit
+          notes = @store.notes(tenant: tenant, limit: limit)
           return [] if facts.empty? && notes.empty?
 
+          legacy_notes = notes.first(@notes_limit)
+          if config && @reranker && !request.message.to_s.strip.empty?
+            selected = select_memory(request, facts, notes.first(config.dig("rerank", "candidate_limit")), config)
+            facts, notes = selected || [facts, legacy_notes]
+          else
+            notes = legacy_notes
+          end
+
           # priority MEMORY (75): between skills (80) and deferred tools (70) in
           # the sacrifice order. pinned false (cuttable under a tight budget).
           [ContextFragment.build(content: format_block(facts, notes, Insika::Fence.enabled?(request.profile)),
@@ -33,6 +50,38 @@ module Insika
 
         private
 
+        def select_memory(request, facts, notes, config)
+          query = request.message.to_s
+          terms = query.downcase.scan(/[[:alnum:]]+/).uniq
+          candidates = facts.map do |fact|
+            { kind: :fact, record: fact, id: "fact:#{fact.key}",
+              text: "#{fact.key} #{fact.value}", at: fact.updated_at.to_s }
+          end + notes.map do |note|
+            { kind: :note, record: note, id: "note:#{note.id}",
+              text: note.text.to_s, at: note.created_at.to_s }
+          end
+          candidates.sort_by! do |item|
+            words = item[:text].downcase.scan(/[[:alnum:]]+/).uniq
+            [-terms.count { |term| words.include?(term) }, -Time.iso8601(item[:at]).to_f, item[:id]]
+          rescue ArgumentError
+            [-terms.count { |term| words.include?(term) }, 0, item[:id]]
+          end
+          candidates = candidates.first(config.dig("rerank", "candidate_limit"))
+          rerank = config.fetch("rerank")
+          timeout = [rerank.fetch("timeout_seconds"),
+                     (request.profile.limits[:provider_timeout] || 5) * 0.9].min
+          documents = candidates.map { |item| item[:text] }
+          indexes = @reranker.select(query: query, documents: documents,
+                                     config: rerank.merge("timeout_seconds" => timeout),
+                                     top_k: config.fetch("top_k"), emit: request.diagnostics,
+                                     source: "Memory", budget: request.profile.limits[:context_budget] || 8_000)
+          return nil unless indexes
+
+          selected = indexes.map { |index| candidates[index] }
+          [selected.filter_map { |item| item[:record] if item[:kind] == :fact },
+           selected.filter_map { |item| item[:record] if item[:kind] == :note }]
+        end
+
         # Engine memory scope (WS8): the request's CUSTOMER-scoped cell
         # ("[tenant:]customer" — engine-owner memory is per customer, never per
         # tenant) wins; otherwise an EXPLICIT tenant from the Command (the

data/lib/insika/context/providers/pending_confirmation.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Insika
+  module Context
+    module Providers
+      # The read path of a customer confirmation: the calls the envelope held on
+      # an earlier turn of this session, rendered at the TAIL of the context —
+      # right before the message that answers them — so the last thing the model
+      # reads before replying is the question the customer is replying to. Zero
+      # bytes when nothing is open, which is every turn of most conversations.
+      class PendingConfirmation < ContextProvider
+        def initialize(pending_action_store:)
+          @store = pending_action_store
+        end
+
+        def id = "pending_confirmation"
+
+        # Pack-declared: no customer_confirm -> no provider.
+        def enabled_for?(profile)
+          list = profile.respond_to?(:customer_confirm) ? profile.customer_confirm : nil
+          !Array(list).empty?
+        end
+
+        def allowlisted? = false # `customer_confirm` is the opt-in, not the allowlist
+
+        def call(request)
+          session = request.respond_to?(:session) ? request.session : nil
+          return [] if session.nil? || @store.nil?
+
+          open = @store.open_for_session(session.id, kind: PendingActionStore::CUSTOMER)
+          return [] if open.empty?
+
+          # A tail fragment IS a history message ({role:, content:}), like the
+          # Briefing's recitation — the Builder appends it after the transcript.
+          [ContextFragment.build(content: { role: :user, content: render(open) }, placement: :tail,
+                                 pinned: true, priority: Context::Priority::PENDING_CONFIRMATION, source: id)]
+        end
+
+        private
+
+        def render(open)
+          lines = open.map { |pa| "- #{pa.tool} #{JSON.generate(pa.args || {})} — pending_id #{pa.id}" }
+          "## Awaiting the customer's confirmation\n#{lines.join("\n")}\n" \
+            "Call confirm_pending only if the customer's message agrees to exactly this. " \
+            "Anything else — a change, a question, a new request — is cancel_pending."
+        end
+      end
+    end
+  end
+end

data/lib/insika/context/providers/prompt.rb

@@ -33,6 +33,9 @@ module Insika
           "the user you found nothing. Do not narrate the retries. Then conclude.\n" \
           "- Tool error: read the error, fix the arguments or try another path; never " \
           "repeat the exact same call.\n" \
+          "- Report an action as done only after its tool call returned success. Never " \
+          "say it happened before the call, and never for a call that failed, was " \
+          "blocked, or is still awaiting confirmation.\n" \
           "- A URL in a tool result (e.g. a `url` field): quote it byte-for-byte. Never " \
           "construct, guess, or rewrite the domain, host, or path."
 
@@ -83,7 +86,9 @@ module Insika
           # NO identity at all, and a chatty model answered plausibly enough to hide
           # it. Additive to prompt_files, not exclusive: an agent may carry both.
           parts << profile&.base_prompt.to_s
-          Array(profile&.prompt_files).each { |src| parts << read_source(profile&.id, src.to_s) }
+          sources = Array(profile&.prompt_files)
+          stored = stored_files(profile, sources)
+          sources.each { |src| parts << read_source(stored, src.to_s) }
           identity = parts.reject { |p| p.nil? || p.strip.empty? }.join("\n\n")
           # Discipline rides an EXISTING identity, never substitutes one: an
           # empty identity here is fatal (`call` raises), not silently patched
@@ -109,10 +114,18 @@ module Insika
           @system_files.list.map { |name| @system_files.read(name).to_s }
         end
 
+        # The agent's files from ONE store read (`contents`); an agent_files object
+        # that only answers `read(agent_id, name)` is read per file, as before.
+        def stored_files(profile, sources)
+          return {} if sources.empty? || profile.id.nil? || @agent_files.nil?
+          return @agent_files.contents(profile.id) if @agent_files.respond_to?(:contents)
+
+          sources.to_h { |src| [src.to_s, @agent_files.read(profile.id, src.to_s)] }.compact
+        end
+
         # Per-agent store first, disk second (compat/seed).
-        def read_source(agent_id, src)
-          stored = agent_id && @agent_files&.read(agent_id, src)
-          return stored if stored
+        def read_source(stored, src)
+          return stored[src] if stored[src]
           return File.read(src, encoding: "UTF-8") if File.exist?(src)
 
           ""

data/lib/insika/context/providers/session.rb

@@ -71,7 +71,11 @@ module Insika
         # Symbol-keyed message preserving tool_calls / tool_call_id when present
         # (a plain message keeps just {role, content} — parity with the old shape).
         def normalize(msg)
+          return msg if msg["native_compaction"]
+
           h = { role: msg[:role] || msg["role"], content: msg[:content] || msg["content"] }
+          attachments = msg[:attachments] || msg["attachments"]
+          h[:attachments] = attachments if attachments && !attachments.empty?
           tool_calls = msg[:tool_calls] || msg["tool_calls"]
           tool_call_id = msg[:tool_call_id] || msg["tool_call_id"]
           h[:tool_calls] = tool_calls if tool_calls
@@ -114,12 +118,44 @@ module Insika
           fresh = fresh_session(session)
           return [[], nil] if fresh.nil?
 
-          messages = fresh.messages || []
+          # Operator corrections affect replay only, never the stored content or tool protocol.
+          messages = (fresh.messages || []).map do |message|
+            if message["role"] == "assistant" && Array(message["tool_calls"]).empty? && message["context_content"].is_a?(String)
+              message.merge("content" => message["context_content"])
+            else
+              message
+            end
+          end
           state = fresh.respond_to?(:compaction) ? fresh.compaction : nil
           upto = state ? state["upto"].to_i : 0
-          return [messages, nil] unless upto.positive? && Coercion.present?(state["summary"])
+          if upto.positive? && state["native"]
+            # ponytail: budget the full fallback too; model-aware allocation can
+            # recover this headroom once model selection precedes context building.
+            prefix = { "native_compaction" => state["native"], "messages" => without_no_reply(messages.take(upto)) }
+            return [[prefix] + without_no_reply(messages.drop(upto)), nil]
+          end
+          return [without_no_reply(messages), nil] unless upto.positive? && Coercion.present?(state["summary"])
+
+          [without_no_reply(messages.drop([upto, messages.size].min)), state]
+        end
 
-          [messages.drop([upto, messages.size].min), state]
+        # `NO_REPLY` is the OpenClaw gateway's silence sentinel. Conversations migrated
+        # from it carry it as agent replies, and the compaction summary restates the
+        # rule ("call_support → responder NO_REPLY"); the Insika prompts forbid the
+        # word (silence is an empty answer here), so replaying it only teaches the
+        # model to write it (Loja Exemplo and Supermercado Exemplo, 23/10/2026).
+        # Replay-only, like the operator corrections above: the stored transcript is
+        # untouched. Applied after the compaction cut so `upto` keeps indexing the
+        # stored list. A message left empty is dropped — the customer never saw it.
+        def without_no_reply(messages)
+          messages.filter_map do |message|
+            content = message["content"]
+            next message unless message["role"] == "assistant" && Array(message["tool_calls"]).empty? &&
+                                content.is_a?(String) && content.include?("NO_REPLY")
+
+            kept = content.lines.grep_v(/NO_REPLY/).join.strip
+            message.merge("content" => kept) unless kept.empty?
+          end
         end
 
         # The compacted prefix as ONE history fragment, rendered FIRST (the

data/lib/insika/context/reranker.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Insika
+  module Context
+    # Optional second pass over already scoped retrieval candidates.
+    class Reranker
+      MAX_INPUT_TOKENS = 4_000
+
+      def initialize(llm:)
+        @llm = llm
+      end
+
+      # Returns indexes into documents, or nil so the caller keeps lexical order.
+      def select(query:, documents:, config:, top_k:, emit: nil, source: "Knowledge", budget: MAX_INPUT_TOKENS)
+        return nil if documents.empty?
+
+        # The same estimator used by the context budget bounds the provider input.
+        tokens = [budget.to_i, MAX_INPUT_TOKENS].min
+        query_tokens = [tokens / 4, 1_000].min
+        per_document = [(tokens - query_tokens) / documents.length, 400].min
+        return nil if per_document < 1
+
+        bounded = documents.map { |text| trim(Insika::Safety::Detectors.redact(text).first, per_document) }
+        bounded_query = trim(Insika::Safety::Detectors.redact(query).first, query_tokens)
+        llm = operation_context(emit, config)
+        result = Async::Task.current.with_timeout(config.fetch("timeout_seconds")) do
+          llm.rerank(bounded_query, bounded, provider: config.fetch("provider"),
+                     model: config.fetch("model"), top_n: top_k)
+        end
+        indexes = result.results.map(&:index)
+        unless indexes.length == [top_k, documents.length].min &&
+               indexes.all? { |index| index.is_a?(Integer) && index >= 0 && index < documents.length } &&
+               indexes.uniq.length == indexes.length
+          safe_emit(emit, :provider_warning, { provider: source, message: "invalid rerank indexes" })
+          return nil
+        end
+        safe_emit(emit, :retrieval_reranked,
+                  { provider: source, candidate_count: documents.length, selected_count: indexes.length })
+        indexes
+      rescue StandardError => error
+        # Provider messages may quote the query or a document. Only the class is safe.
+        safe_emit(emit, :provider_warning, { provider: source, message: "rerank failed: #{error.class.name}" })
+        nil
+      end
+
+      private
+
+      def trim(value, limit)
+        text = value.to_s[0, limit * 4]
+        text = text[0...-1] while TokenEstimator.estimate(text) > limit
+        text
+      end
+
+      def safe_emit(emit, type, data)
+        emit&.call(type, data)
+      rescue StandardError
+        nil
+      end
+
+      def operation_context(emit, config)
+        source = @llm.respond_to?(:call) ? @llm.call : @llm
+        return source unless emit && source.respond_to?(:config)
+
+        require "ruby_llm"
+        require_relative "../telemetry/ruby_llm_instrumenter"
+        copy = source.config.dup
+        copy.instrumenter = Insika::Telemetry::RubyLLMInstrumenter.new(
+          delegate: copy.instrumenter, operation: "rerank", model: config.fetch("model"),
+          emit: ->(type, data) { safe_emit(emit, type, data) }
+        )
+        RubyLLM::Context.new(copy)
+      end
+    end
+  end
+end

data/lib/insika/distill.rb

@@ -73,7 +73,7 @@ module Insika
       DROP_KEYS = %w[schema unknown_key oversized bad_turns duplicate capped].freeze
 
       # ask:   ->(prompt) { "<raw model text>" } | something answering #content
-      #        (+ #input_tokens/#output_tokens/#cached_tokens for cost).
+      #        (+ RubyLLM-compatible #tokens for cost).
       # model: the ref recorded in the events ("utility_model" default).
       attr_reader :model
 
@@ -93,7 +93,7 @@ module Insika
       # Drops are counted, never fixed up.
       def distill(prompt:, message_count:, max_proposals: 10)
         answer = @ask.call(prompt)
-        raw = parse(text_of(answer))
+        raw = parse(answer)
         proposals = []
         dropped = DROP_KEYS.to_h { |k| [k, 0] }
         seen = {}
@@ -124,20 +124,25 @@ module Insika
       # nil when the provider said nothing — never 0 (the Proposer's
       # discipline). The cached prefix is INCLUDED in the spent total.
       def cost_of(answer)
-        return nil unless answer.respond_to?(:input_tokens) && answer.respond_to?(:output_tokens)
+        return nil unless answer.respond_to?(:tokens)
 
-        input = answer.input_tokens.to_i
-        output = answer.output_tokens.to_i
-        cached = answer.respond_to?(:cached_tokens) ? answer.cached_tokens.to_i : 0
-        spent = input + output + cached
+        usage = answer.tokens
+        input = usage.input.to_i
+        output = usage.output.to_i
+        cached = usage.cache_read.to_i
+        spent = input + output + cached + usage.cache_write.to_i
         spent.positive? ? { "spent" => spent, "cached" => cached } : nil
       end
 
-      # Fences are stripped, the payload parsed STRICTLY: a model that
-      # improvises a schema fails here instead of producing half a proposal.
-      def parse(raw)
-        body = raw.strip.gsub(/\A```(?:json)?\s*|\s*```\z/, "")
-        parsed = JSON.parse(body)
+      # Native responses own JSON parsing; injected text asks retain their
+      # existing fenced-JSON contract. Domain validation still runs below.
+      def parse(answer)
+        parsed = if answer.respond_to?(:parsed)
+                   answer.parsed
+                 else
+                   JSON.parse(text_of(answer).strip.gsub(/\A```(?:json)?\s*|\s*```\z/, ""))
+                 end
+        parsed = parsed["items"] if parsed.is_a?(Hash)
         raise Unusable, "the distiller's answer is not an array" unless parsed.is_a?(Array)
 
         parsed
@@ -215,8 +220,12 @@ module Insika
         require "ruby_llm"
         llm ||= RubyLLM
         lambda do |prompt|
+          # DeepSeek's native adapter uses JSON-object mode, requiring an envelope.
+          schema = { "type" => "object", "properties" => { "items" => PROPOSAL_SCHEMA.json_schema },
+                     "required" => ["items"], "additionalProperties" => false }
           llm.chat(model: model, provider: provider, assume_model_exists: true)
-             .with_temperature(0).ask(prompt)
+             .with_temperature(0).with_schema("schema" => schema, "strict" => false)
+             .ask("#{prompt}\n\nReturn the requested array inside a JSON object with the key \"items\".")
         end
       end
     end

data/lib/insika/doctor.rb

@@ -181,7 +181,7 @@ module Insika
                     check_memory_scopes check_funnel_declarations check_followup check_distill
                     check_compaction check_harvest check_schedules check_guardrail_corpora
                     check_tool_allowlist_policy check_fencing check_eval_seeding
-                    check_presentation_tools check_provenance]
+                    check_presentation_tools check_provenance check_customer_confirm]
 
     def safe(check)
       Array(send(check))
@@ -316,16 +316,18 @@ module Insika
       [Finding.new(check: "default-model", severity: :warn, message: msg, fix: fix)]
     end
 
+    def backend_name = @backend.class.name.split("::").last
+
     def check_db
-      unless @backend.is_a?(Insika::Stores::SQLite)
+      unless Insika::Stores.durable?(@backend)
         return [Finding.new(check: "db", severity: :info,
                             message: "ephemeral backend (INSIKA_DB unset) — config and state do NOT survive a restart", fix: nil)]
       end
 
       @backend.get("__doctor__", "probe") # a read round-trips the handle; raises if the file is broken
-      [ok("db", "durable backend: SQLite (readable)")]
+      [ok("db", "durable backend: #{backend_name} (readable)")]
     rescue StandardError => e
-      [Finding.new(check: "db", severity: :error, message: "SQLite backend not usable: #{e.class}: #{e.message}", fix: nil)]
+      [Finding.new(check: "db", severity: :error, message: "#{backend_name} backend not usable: #{e.class}: #{e.message}", fix: nil)]
     end
 
     def check_llm_provider
@@ -1009,6 +1011,31 @@ def wrapped_content?(content) = /\A\s*\{\s*"[^"]+"\s*=>/.match?(content.to_s)
       end
     end
 
+    # `customer_confirm` names tools; one the agent denies, or leaves out of an
+    # explicit allowlist, is a hold that can never happen. An allowlist carrying an
+    # `mcp:` entry is not explicit about tool NAMES (the server contributes them),
+    # so it is not judged.
+    def check_customer_confirm
+      return [] unless @profile_source
+
+      findings = @profile_source.all.flat_map do |profile|
+        names = profile.respond_to?(:customer_confirm) ? Array(profile.customer_confirm) : []
+        next [] if names.empty?
+
+        allow = profile.tools_allow
+        explicit = !allow.nil? && Array(allow).none? { |a| a.to_s.start_with?("mcp:") }
+        dead = names.select do |name|
+          Array(profile.tools_deny).include?(name) || (explicit && !Array(allow).include?(name))
+        end
+        next [] if dead.empty?
+
+        [Finding.new(check: "customer_confirm", severity: :warn, fix: nil,
+                     message: "agent '#{profile.id}' lists #{dead.join(', ')} under customer_confirm but does " \
+                              "not allow the tool — the hold can never happen")]
+      end
+      findings.empty? ? [ok("customer_confirm", "customer_confirm: every held tool is allowed")] : findings
+    end
+
     def check_grounding
       return [] unless @profile_source
 
@@ -1381,6 +1408,9 @@ def wrapped_content?(content) = /\A\s*\{\s*"[^"]+"\s*=>/.match?(content.to_s)
       settings = @settings_store.get
       config = settings["compaction"] || {}
       return [ok("compaction", "in-session compaction off")] unless Coercion.truthy?(config["enabled"])
+      if config["mode"] == "native"
+        return [ok("compaction", "native compaction on for supported Responses models; no summary fallback")]
+      end
 
       if Coercion.presence(config["model"]).nil? && Coercion.presence(settings["utility_model"]).nil?
         [Finding.new(check: "compaction", severity: :warn, fix: nil,