protege 0.1.0.alpha.1

data/app/tools/protege/web_fetch_tool.rb

@@ -0,0 +1,224 @@
+# frozen_string_literal: true
+
+require 'resolv'
+require 'ipaddr'
+
+module Protege
+  # Built-in web-fetch tool — the way an agent reads a page or file from the open web. Subclasses
+  # +Protege::Tool+, so the harness publishes it in the LLM's tool catalog (id +:web_fetch+); when
+  # the model emits a +web_fetch+ call, the harness routes the arguments to +#use+.
+  #
+  # It is deliberately conservative, because the URL is agent-supplied and could be steered by prompt
+  # injection: only +http+/+https+ is allowed; hosts that resolve to private, loopback, or link-local
+  # addresses are refused (an SSRF guard, re-checked on every redirect) so the agent can never reach
+  # internal network endpoints; redirects are followed manually up to {MAX_REDIRECTS}; and the response
+  # is size-capped. HTML is reduced to readable text (tags stripped); other text-like content is
+  # returned as-is; binary content (images, PDFs, video) is refused — use +read_attachment+ for files
+  # the agent already has.
+  class WebFetchTool < Protege::Tool
+    # Maximum number of redirect hops followed before giving up.
+    MAX_REDIRECTS = 3
+
+    # Hard ceiling (from the +Content-Length+ header) above which the fetch is refused outright.
+    MAX_BYTES = 5_000_000
+
+    # Returned text is truncated to this many characters (with +truncated: true+) so a huge page can
+    # never blow up the model's context.
+    MAX_CONTENT_CHARS = 100_000
+
+    # Connection- and read-timeouts (seconds) for the HTTP request.
+    OPEN_TIMEOUT = 5
+    READ_TIMEOUT = 10
+
+    # HTTP statuses treated as redirects (the +Location+ header is followed).
+    REDIRECT_STATUSES = [301, 302, 303, 307, 308].freeze
+
+    description <<~DESC.strip
+      Fetch a web page or text file by URL and return its readable contents. Use this to read a page
+      you found (e.g. via web_search) or a link someone sent you.
+
+      Provide an absolute http or https url. HTML pages are returned as plain readable text (markup
+      stripped); plain-text and JSON are returned as-is. Very large pages are truncated (you'll see
+      truncated: true). Binary files (images, PDFs, video) cannot be read this way. Requests to
+      internal/private network addresses are refused.
+    DESC
+
+    input_schema(
+      type:                 'object',
+      additionalProperties: false,
+      required:             %w[url],
+      properties:           {
+        url: {
+          type:        'string',
+          description: 'The absolute http(s) URL to fetch.'
+        }
+      }
+    )
+
+    # Fetch the URL and return its readable text.
+    #
+    # @param context [Protege::Orchestrator::Context] the per-delivery tool context (unused)
+    # @param url [String] the absolute http(s) URL supplied by the model
+    # @return [Protege::Result] success carrying the final +url+, +status+, +content_type+, +content+,
+    #   and +truncated+ flag, or a failure (bad scheme, blocked address, non-2xx, non-text, timeout, or
+    #   too many redirects)
+    def use(context:, url:)
+      fetch(url:, redirects_left: MAX_REDIRECTS)
+    rescue Faraday::Error => e
+      failure(reason: "could not fetch #{url}: #{e.message}")
+    end
+
+    private
+
+    # Resolve, guard, and fetch a single URL, following one redirect by recursing with a decremented
+    # budget. Every hop re-validates the scheme and the SSRF guard against the (possibly new) host.
+    #
+    # @param url [String] the URL to fetch on this hop
+    # @param redirects_left [Integer] remaining redirect budget
+    # @return [Protege::Result] the outcome
+    def fetch(url:, redirects_left:)
+      uri = parse_http_uri(url)
+      return failure(reason: "#{url.inspect} is not a valid http(s) URL") unless uri
+      if blocked?(uri.hostname)
+        return failure(reason: "refusing to fetch a private or internal address (#{uri.hostname})")
+      end
+
+      response = connection.get(uri.to_s)
+      return follow_redirect(uri:, response:, redirects_left:) if REDIRECT_STATUSES.include?(response.status)
+      unless (200..299).cover?(response.status)
+        return failure(reason: "fetch of #{uri} returned HTTP #{response.status}")
+      end
+      if oversized?(response)
+        return failure(reason: "response from #{uri} is too large (#{content_length(response)} bytes)")
+      end
+
+      render(uri:, response:)
+    end
+
+    # Follow a redirect response's +Location+, enforcing the hop budget.
+    #
+    # @return [Protege::Result] the next hop's outcome, or a failure when there is no Location or the
+    #   budget is exhausted
+    def follow_redirect(uri:, response:, redirects_left:)
+      location = response.headers['location'].to_s
+      return failure(reason: "redirect from #{uri} had no Location header") if location.empty?
+      return failure(reason: "too many redirects starting at #{uri}") if redirects_left <= 0
+
+      fetch(url: URI.join(uri.to_s, location).to_s, redirects_left: redirects_left - 1)
+    end
+
+    # Turn a successful response into a result, converting HTML to text and refusing binary content.
+    #
+    # @return [Protege::Result] success with the readable content, or a non-text failure
+    def render(uri:, response:)
+      type = content_type(response)
+      return failure(reason: "can't read non-text content (#{type || 'unknown type'})") unless textual?(type)
+
+      text      = type == 'text/html' ? strip_html(response.body.to_s) : response.body.to_s
+      truncated = text.length > MAX_CONTENT_CHARS
+      text      = text[0, MAX_CONTENT_CHARS] if truncated
+
+      success(url: uri.to_s, status: response.status, content_type: type, content: text, truncated:)
+    end
+
+    # Parse a string into an http(s) URI, or +nil+ when it is not a valid absolute web URL.
+    #
+    # @param url [String] the candidate URL
+    # @return [URI::HTTP, nil] the parsed URI (URI::HTTPS is a URI::HTTP), or nil
+    def parse_http_uri(url)
+      uri = URI.parse(url.to_s.strip)
+      uri if uri.is_a?(URI::HTTP) && uri.hostname
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    # Whether a host must not be fetched: any of its resolved addresses (or the literal itself) is
+    # private, loopback, or link-local.
+    #
+    # @param host [String] the URI hostname (brackets already stripped by URI#hostname)
+    # @return [Boolean] true when the host should be refused
+    def blocked?(host)
+      addresses_for(host).any? { |ip| private_address?(ip) }
+    end
+
+    # The IP addresses to vet for a host: the literal itself when it is already an IP, otherwise every
+    # address it resolves to. An unresolvable host yields no addresses (the request then fails naturally
+    # at the transport layer).
+    #
+    # @param host [String] the hostname or IP literal
+    # @return [Array<String>] addresses to check
+    def addresses_for(host)
+      IPAddr.new(host)
+      [host]
+    rescue IPAddr::InvalidAddressError
+      Resolv.getaddresses(host)
+    end
+
+    # Whether an IP string falls in a range the agent must never reach.
+    #
+    # @param ip [String] an IP address
+    # @return [Boolean] true for private/loopback/link-local (or unparseable) addresses
+    def private_address?(ip)
+      addr = IPAddr.new(ip)
+      addr.loopback? || addr.private? || addr.link_local?
+    rescue IPAddr::InvalidAddressError
+      true
+    end
+
+    # The response's media type, lower-cased and without parameters (e.g. +text/html+), or nil.
+    #
+    # @param response [Faraday::Response] the HTTP response
+    # @return [String, nil] the bare content type
+    def content_type(response)
+      response.headers['content-type'].to_s.split(';').first&.strip&.downcase.presence
+    end
+
+    # Whether a media type is readable as text: text/*, JSON, XML, or a +json/+xml structured suffix.
+    #
+    # @param type [String, nil] the bare content type
+    # @return [Boolean] true when the body should be treated as text
+    def textual?(type)
+      return true if type.nil? # servers that omit the type are treated as text/plain
+
+      type.start_with?('text/') ||
+        %w[application/json application/xml application/xhtml+xml].include?(type) ||
+        type.end_with?('+json', '+xml')
+    end
+
+    # Whether the advertised +Content-Length+ exceeds the hard cap.
+    #
+    # @param response [Faraday::Response] the HTTP response
+    # @return [Boolean] true when too large to accept
+    def oversized?(response)
+      length = content_length(response)
+      length && length > MAX_BYTES
+    end
+
+    # The advertised content length, or nil when the header is absent.
+    #
+    # @param response [Faraday::Response] the HTTP response
+    # @return [Integer, nil] the byte count
+    def content_length(response)
+      response.headers['content-length']&.to_i
+    end
+
+    # Reduce an HTML document to readable text using the same tag-stripper the mail layer uses.
+    #
+    # @param html [String] the HTML body
+    # @return [String] the stripped, trimmed text
+    def strip_html(html)
+      ActionController::Base.helpers.strip_tags(html).strip
+    end
+
+    # Build (and memoize) the Faraday client used for every hop.
+    #
+    # @return [Faraday::Connection] the configured HTTP client
+    def connection
+      @connection ||= Faraday.new do |c|
+        c.headers['User-Agent'] = Protege.configuration.http_user_agent
+        c.options.open_timeout  = OPEN_TIMEOUT
+        c.options.timeout       = READ_TIMEOUT
+      end
+    end
+  end
+end

data/app/tools/protege/web_search_tool.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require 'nokogiri'
+
+module Protege
+  # Built-in web-search tool — the way an agent finds pages on the open web. Subclasses
+  # +Protege::Tool+, so the harness publishes it in the LLM's tool catalog (id +:web_search+); when
+  # the model emits a +web_search+ call, the harness routes the arguments to +#use+.
+  #
+  # It is a keyless, best-effort search: it scrapes DuckDuckGo's HTML endpoint and parses the results
+  # page into a list of +{title, url, snippet}+ the agent can reason over and then +web_fetch+. Because
+  # it scrapes an unofficial endpoint, it can change or be rate-limited — that trade-off buys a search
+  # that needs no API key and is safe to expose to every persona. Richer or keyed search (Tavily,
+  # Perplexity, Brave, …) belongs in a host-app tool, keyed from the host's own config.
+  class WebSearchTool < Protege::Tool
+    # Result count when the caller does not specify a +limit+.
+    DEFAULT_LIMIT = 5
+
+    # Absolute ceiling on the result count, regardless of the requested +limit+.
+    MAX_LIMIT = 25
+
+    # DuckDuckGo's HTML results endpoint (no API key required).
+    ENDPOINT = 'https://html.duckduckgo.com/html/'
+
+    # Connection- and read-timeouts (seconds) for the HTTP request.
+    OPEN_TIMEOUT = 5
+    READ_TIMEOUT = 10
+
+    description <<~DESC.strip
+      Search the web and get back a list of matching pages (title, url, snippet). Use this to find
+      current information or sources, then use web_fetch to read a result's url in full.
+
+      Provide a query string. Optionally set limit to cap the number of results (default 5, maximum
+      25). Results come from DuckDuckGo and are best-effort — refine the query rather than raising the
+      limit when results are off.
+    DESC
+
+    input_schema(
+      type:                 'object',
+      additionalProperties: false,
+      required:             %w[query],
+      properties:           {
+        query: {
+          type:        'string',
+          description: 'The search query.'
+        },
+        limit: {
+          type:        'integer',
+          description: 'Maximum number of results to return. Defaults to 5; capped at 25.'
+        }
+      }
+    )
+
+    # Run the search and return the matching pages.
+    #
+    # @param context [Protege::Orchestrator::Context] the per-delivery tool context (unused)
+    # @param query [String] the search query supplied by the model
+    # @param limit [Integer, nil] optional result cap (defaults to {DEFAULT_LIMIT}, capped at {MAX_LIMIT})
+    # @return [Protege::Result] success carrying +query+, +count+, and +results+, or a failure (blank
+    #   query, non-2xx, or transport error)
+    def use(context:, query:, limit: nil)
+      term = query.to_s.strip
+      return failure(reason: 'query cannot be empty') if term.empty?
+
+      response = connection.get(ENDPOINT) { |req| req.params['q'] = term }
+      return failure(reason: "web search returned HTTP #{response.status}") unless (200..299).cover?(response.status)
+
+      results = parse_results(response.body.to_s).first(clamp(limit))
+      success(query: term, count: results.size, results:)
+    rescue Faraday::Error => e
+      failure(reason: "web search failed: #{e.message}")
+    end
+
+    private
+
+    # Clamp the requested limit into 1..{MAX_LIMIT}, defaulting when none is given.
+    #
+    # @param limit [Integer, nil] the requested cap
+    # @return [Integer] the effective cap
+    def clamp(limit)
+      (limit || DEFAULT_LIMIT).to_i.clamp(1, MAX_LIMIT)
+    end
+
+    # Parse a DuckDuckGo HTML results page into result hashes, skipping ad rows and rows without a
+    # usable link.
+    #
+    # @param html [String] the results-page HTML
+    # @return [Array<Hash>] +{title:, url:, snippet:}+ for each organic result, in page order
+    def parse_results(html)
+      Nokogiri::HTML(html).css('div.result').filter_map do |node|
+        next if node['class'].to_s.include?('result--ad')
+
+        link = node.at_css('a.result__a')
+        url  = link && result_url(link['href'])
+        next unless url
+
+        { title: link.text.strip, url:, snippet: node.at_css('.result__snippet')&.text&.strip }
+      end
+    end
+
+    # Extract the real destination from a DuckDuckGo result href, which wraps external links as
+    # +//duckduckgo.com/l/?uddg=<url-encoded target>&rut=…+. Protocol-relative or already-direct hrefs
+    # are normalized/returned as-is.
+    #
+    # @param href [String, nil] the anchor's href
+    # @return [String, nil] the destination URL, or nil when there is nothing usable
+    def result_url(href)
+      href = href.to_s
+      return nil if href.empty?
+
+      if href.include?('uddg=')
+        URI.decode_www_form(href.split('?', 2).last.to_s).to_h['uddg']
+      elsif href.start_with?('//')
+        "https:#{href}"
+      else
+        href
+      end
+    end
+
+    # Build (and memoize) the Faraday client for the search request.
+    #
+    # @return [Faraday::Connection] the configured HTTP client
+    def connection
+      @connection ||= Faraday.new do |c|
+        c.headers['User-Agent'] = Protege.configuration.http_user_agent
+        c.options.open_timeout  = OPEN_TIMEOUT
+        c.options.timeout       = READ_TIMEOUT
+      end
+    end
+  end
+end

data/app/views/layouts/protege/application.html.slim

@@ -0,0 +1,19 @@
+doctype html
+
+html lang="en" class="h-full"
+  head
+    title Protege
+    meta name="viewport" content="width=device-width,initial-scale=1"
+
+    = csrf_meta_tags
+    = csp_meta_tag
+
+    = stylesheet_link_tag "protege", data: { "turbo-track": "reload" }
+
+    = javascript_importmap_tags
+    = javascript_include_tag(*js_files)
+
+  = app_body do
+    = yield
+
+    = render "protege/shared/hotkeys"

data/app/views/protege/access_rules/create.turbo_stream.slim

@@ -0,0 +1,6 @@
+- if @access_rule.persisted?
+  = turbo_stream.append "access_rules", partial: "protege/personas/access_rule", locals: { access_rule: @access_rule }
+  = turbo_stream.remove "access_rules_empty"
+  = turbo_stream.replace "access_rule_form", partial: "protege/personas/access_rule_form", locals: { persona: @persona, access_rule: @persona.access_rules.build }
+- else
+  = turbo_stream.replace "access_rule_form", partial: "protege/personas/access_rule_form", locals: { persona: @persona, access_rule: @access_rule }

data/app/views/protege/email_domains/_email_domain_sidebar_item.html.slim

@@ -0,0 +1,4 @@
+= sidebar_item(email_domain.domain, email_domain_path(email_domain),
+    subtitle: "DKIM: #{email_domain.dkim_selector}._domainkey",
+    active: local_assigns[:active],
+    id: dom_id(email_domain))

data/app/views/protege/email_domains/_form.html.slim

@@ -0,0 +1,10 @@
+= form_with url: (email_domain.new_record? ? email_domains_path : email_domain_path(email_domain)), model: email_domain do |f|
+  = form_errors(email_domain)
+
+  .space-y-4
+    = form_field(f, :domain, placeholder: "mail.example.com")
+
+    = form_field(f, :dkim_selector, label: "DKIM selector", placeholder: "default", hint: "Used as the prefix for the DKIM TXT record name.")
+
+    .pt-2
+      = button(email_domain.new_record? ? "Add domain" : "Save changes", type: :submit)

data/app/views/protege/email_domains/_sidebar.html.slim

@@ -0,0 +1,11 @@
+- pagy, domains = paginate(all_email_domains)
+
+= sidebar_content do
+  = sidebar_header("Domains (#{pagy.count})", new_path: new_email_domain_path)
+
+  = sidebar_stream("protege:email_domains", pagy: pagy)
+
+  = sidebar_body(domains, empty: "No domains yet", id: "email_domains_list") do |email_domain|
+    = render "email_domain_sidebar_item", email_domain: email_domain, active: local_assigns[:current] == email_domain
+
+  = sidebar_pagination(pagy)

data/app/views/protege/email_domains/index.html.slim

@@ -0,0 +1,6 @@
+- content_for :sidebar do
+  = render "sidebar"
+
+= page_empty do
+  | Select a domain from the sidebar, or  
+  = ui_link("add a new one.", new_email_domain_path)

data/app/views/protege/email_domains/new.html.slim

@@ -0,0 +1,7 @@
+- content_for :sidebar do
+  = render "sidebar"
+
+= page_container do
+  = page_header("Add email domain", "A DKIM keypair is generated automatically. DNS records are shown after saving.")
+
+  = card { render "form", email_domain: @email_domain }

data/app/views/protege/email_domains/show.html.slim

@@ -0,0 +1,36 @@
+- content_for :sidebar do
+  = render "sidebar", current: @email_domain
+
+= page_container do
+  = page_header(@email_domain.domain, "Configure these DNS records at your registrar or DNS provider.") do
+    = button("Remove", type: "button", variant: :danger, onclick: show_dialog("remove-domain"))
+
+  .space-y-4
+    = info_card("MX record", { "Name" => "#{@email_domain.domain}.", "Value" => @email_domain.mx_record })
+
+    = info_card("SPF record (TXT)", { "Name" => "#{@email_domain.domain}.", "Value" => @email_domain.spf_txt_record })
+
+    / DKIM signing is ours only when we self-host the MTA; an email provider signs with its own key, so we
+    / point the operator at the provider's records rather than publishing this domain's key.
+    - if mail_self_hosted?
+      = info_card("DKIM record (TXT)", { "Name" => "#{@email_domain.dkim_dns_name}.", "Value" => @email_domain.dkim_txt_record })
+    - else
+      = info_card("DKIM record (TXT)", { "Note" => "Managed by your email provider — publish the DKIM records it gives you." })
+
+    = info_card("DMARC record (TXT)", { "Name" => "_dmarc.#{@email_domain.domain}.", "Value" => @email_domain.dmarc_txt_record })
+
+    / Self-hosting only: saved domains are pushed to the MTA automatically; this is the manual re-push.
+    - if mail_self_hosted?
+      = card do
+        = heading_2("Mail server")
+        p.mt-1.text-sm style="color: var(--text-muted)"
+          | Saved domains are pushed to your self-hosted mail server automatically. Use Sync now to re-push — for example after the mail server restarts.
+        .mt-3
+          = action_button("Sync now", email_domain_mta_domains_sync_path(@email_domain))
+
+= render("protege/shared/confirm_dialog",
+    id: "remove-domain",
+    title: "Remove #{@email_domain.domain}?",
+    message: "Removing this domain only deletes it from Protege. It does not affect your DNS records. If this domain is in use by a persona, you will need to de-register the MX, SPF, DKIM, and DMARC entries with your DNS provider separately.",
+    action_url: email_domain_path(@email_domain),
+    action_text: "Remove domain")

data/app/views/protege/home/show.html.slim

@@ -0,0 +1,26 @@
+= page_container do
+  = page_header('About Protege')
+
+  div class="space-y-4 text-sm leading-relaxed mb-10"
+    p Protege is an email-native AI agent toolkit. Your personas receive email, process it through an inference pipeline, and respond autonomously using the tools you configure. Every conversation — whether from an external email client or this console — flows through the same harness.
+
+    p To get started, configure at least one email domain with valid DNS records, create a persona with a routable email address, and set up your provider credentials. Once a persona is active and your MTA is running, it will process inbound email automatically.
+
+    p Protege is a toolkit for developers, not an out-of-the-box solution. Every part of the pipeline — providers, resolvers, tools, hooks — is an extension surface you implement. The #{ui_link("documentation", "https://docs.protege.bot", target: "_blank")} covers each surface in detail with examples and guides.
+
+  div class="mt-10"
+    div class="mb-4"
+      = heading_2("Extension surfaces")
+
+    = grid_container(cols: 2) do
+      = grid_card("Personas", "The agent identity that receives and responds to email. Each persona has its own address, resolver chain, and display name.", href: "https://docs.protege.bot/personas")
+      
+      = grid_card("Providers", "LLM provider integration — OpenRouter, Anthropic, or any OpenAI-compatible endpoint.", href: "https://docs.protege.bot/providers")
+      
+      = grid_card("Resolvers", "Build inference context before each generation — system prompts, conversation history, or custom data.", href: "https://docs.protege.bot/resolvers")
+      
+      = grid_card("Tools", "Capabilities exposed to the LLM — send email, query APIs, or anything you implement.", href: "https://docs.protege.bot/tools")
+      
+      = grid_card("Hooks", "Subscribe to lifecycle events — inference, tool calls, failures — for logging, metrics, or side effects.", href: "https://docs.protege.bot/hooks")
+      
+      = grid_card("Gateway", "Inbound and outbound email transport — SMTP, console messages, threading, and persistence.", href: "https://docs.protege.bot/gateway")

data/app/views/protege/messages/_message.html.slim

@@ -0,0 +1,19 @@
+= turbo_frame_tag dom_id(message) do
+  div class="py-4" style="border-top: 1px solid var(--border)"
+    div class="flex items-start justify-between text-sm"
+      = message_sender(message)
+      div class="flex items-center gap-3"
+        = message_timestamp(message)
+        = dropdown_menu do
+          = dropdown_item("Delete", message_path(message), method: :delete, destructive: true)
+
+    = message_recipients(message)
+    
+    = message_subject(message)
+    
+    = message_headers(message)
+    
+    .mt-3
+      = body_text(message.text_body.to_s.strip)
+
+    = message_attachments(message)

data/app/views/protege/messages/_sidebar.html.slim

@@ -0,0 +1,13 @@
+- pagy, messages = paginate(results)
+- empty_message = search.active? ? "No emails match your search" : "Enter search terms to find emails"
+
+= sidebar_content(frame: "search_results") do
+  = sidebar_header("Results (#{pagy.count})")
+
+  = sidebar_body(messages, empty: empty_message) do |message|
+    = sidebar_item(search_result_title(message), thread_path(message.email_thread, anchor: dom_id(message)),
+        detail: search_result_date(message),
+        subtitle: message.from_address,
+        data: { turbo_frame: "_top" })
+
+  = sidebar_pagination(pagy)

data/app/views/protege/messages/index.html.slim

@@ -0,0 +1,20 @@
+- content_for :sidebar do
+  = render "sidebar", search: @search, results: @messages
+
+= page_container do
+  = page_header("Search emails", "Find emails by sender, recipients, subject, body, or attachment. Matches appear in the sidebar.")
+
+  = card do
+    = form_with url: messages_path, method: :get, data: { turbo_frame: "search_results" }, class: "space-y-5" do |f|
+      = form_field(f, :from, label: "From", placeholder: "sender address", value: params[:from], onblur: "this.form.requestSubmit()")
+
+      = form_field(f, :recipients, label: "Recipients", placeholder: "to, cc, or bcc address", value: params[:recipients], onblur: "this.form.requestSubmit()")
+
+      = form_field(f, :subject, label: "Subject", placeholder: "subject contains…", value: params[:subject], onblur: "this.form.requestSubmit()")
+
+      = form_field(f, :body, label: "Body", placeholder: "body contains…", value: params[:body], onblur: "this.form.requestSubmit()")
+
+      = form_field(f, :attachments, label: "Attachments", placeholder: "filename contains…", value: params[:attachments], onblur: "this.form.requestSubmit()")
+
+      .pt-2
+        = button("Search", type: :submit)

data/app/views/protege/personas/_access_rule.html.slim

@@ -0,0 +1,7 @@
+tr id=dom_id(access_rule) style="border-top: 1px solid var(--border)"
+  td class="py-3 pr-4 align-middle"
+    = badge(access_rule.kind, access_rule.allow? ? :green : :red)
+  td class="py-3 pr-4 align-middle"
+    code class="font-mono break-all" = access_rule.pattern
+  td class="py-3 align-middle"
+    = destructive_link("Remove", persona_access_rule_path(access_rule.persona, access_rule), confirm: "Remove this rule?")

data/app/views/protege/personas/_access_rule_form.html.slim

@@ -0,0 +1,8 @@
+#access_rule_form
+  = form_with model: access_rule, url: persona_access_rules_path(persona), scope: :access_rule, class: "space-y-3" do |f|
+    = form_errors(access_rule)
+    .flex.items-end.gap-3
+      = form_select(f, :kind, Protege::AccessRule.kinds.keys.map { |k| [k.capitalize, k] }, label: "Kind")
+      .flex-1
+        = form_field(f, :pattern, label: "Pattern", placeholder: "*@company.co")
+      = button("Add rule", type: :submit, class: "h-9")

data/app/views/protege/personas/_access_rules.html.slim

@@ -0,0 +1,19 @@
+/ Inbound access rules for a persona — the dashboard-editable, narrowing layer of the access
+/ guardrail. Lists existing rules with a remove control and an add form. Create/destroy update the
+/ table in place via Turbo Streams (the persona page survives), falling back to a redirect for non-Turbo.
+
+= card do
+  .space-y-4
+    = heading_2("Inbound access rules")
+    = hint("Allow or deny senders for this agent. Rules only narrow the global policy — they can never widen it.")
+
+    = render "access_rule_form", persona: persona, access_rule: persona.access_rules.build
+
+    table class="w-full text-sm"
+      tbody id="access_rules"
+        - if persona.access_rules.any?
+          = render partial: "access_rule", collection: persona.access_rules.order(:kind, :pattern), as: :access_rule
+        - else
+          tr id="access_rules_empty"
+            td colspan="3" class="py-6 text-center text-sm" style="color: var(--text-faint)"
+              | No rules — every sender permitted by the global policy can reach this agent.

data/app/views/protege/personas/_actions.html.slim

@@ -0,0 +1,15 @@
+/ The persona show page's action bar — Edit, Archive/Unarchive, and permanent Delete — plus an "Archived"
+/ badge when soft-removed. Wrapped in a dom_id so Archive/Unarchive can replace it in place over Turbo
+/ (see ArchivesController). The Delete button opens the confirm dialog rendered by the show template.
+div id=dom_id(persona, :actions) class="flex items-center gap-3"
+  - if persona.archived?
+    = badge("Archived")
+
+  = ui_link("Edit", edit_persona_path(persona))
+
+  - if persona.archived?
+    = action_button("Unarchive", persona_archive_path(persona), method: :delete)
+  - else
+    = action_button("Archive", persona_archive_path(persona), method: :post, variant: :secondary)
+
+  = button("Delete", type: "button", variant: :danger, onclick: show_dialog("delete-persona"))

data/app/views/protege/personas/_form.html.slim

@@ -0,0 +1,29 @@
+- url = persona.new_record? ? personas_path : persona_path(persona)
+- method = persona.new_record? ? :post : :patch
+
+= form_with url:, method:, scope: :persona, class: "space-y-5" do |f|
+  = form_errors(persona)
+
+  = form_field(f, :name, placeholder: "e.g. alice")
+
+  = form_email_address(persona, available_email_domains)
+
+  - unless persona.new_record?
+    = hint("Changing the address only affects new mail — messages to the old address will no longer reach this persona. Existing threads and history are unaffected.")
+
+  - if persona.new_record?
+    = form_select(f, :type, available_persona_types.map { |k| [k.display_name, k.name] }, label: "Type")
+
+  = form_text_area(f, :instructions, \
+                      label: "Instructions", \
+                      rows: 10, \
+                      hint: "The agent's system prompt — who it is and how it behaves. Only sent to the model when a resolver (such as LoadText) includes it in the agent's context.")
+
+  - unless persona.new_record?
+    - tool_id = ->(tool) { tool.id.to_s }
+    = form_checklist(f, :disabled_tool_ids, persona_tool_options(persona), label: "Blocked Tools", value: tool_id, text: tool_id, hint: "Disabled tools aren't offered to the agent; everything else stays available.")
+
+  .flex.items-center.gap-3.pt-2
+    = button(persona.new_record? ? "Create persona" : "Save changes", type: :submit)
+
+    = ui_link("Cancel", persona.new_record? ? personas_path : persona_path(persona))

data/app/views/protege/personas/_persona_sidebar_item.html.slim

@@ -0,0 +1,5 @@
+= sidebar_item(persona_label(persona), persona_path(persona),
+    detail: persona_status(persona),
+    subtitle: persona.email_address,
+    active: local_assigns[:active],
+    id: dom_id(persona))

data/app/views/protege/personas/_sidebar.html.slim

@@ -0,0 +1,11 @@
+- pagy, personas = paginate(all_personas)
+
+= sidebar_content do
+  = sidebar_header("Personas (#{pagy.count})", new_path: new_persona_path)
+
+  = sidebar_stream("protege:personas", pagy: pagy)
+
+  = sidebar_body(personas, empty: "No personas yet", id: "personas_list") do |persona|
+    = render "persona_sidebar_item", persona: persona, active: local_assigns[:current] == persona
+
+  = sidebar_pagination(pagy)